Repository navigation
Sync/apache main oct - #126
Merged
Merged
Sync/apache main oct #126
Conversation
Co-authored-by: Gean Jair Silva <gean.silva@scclouds.com.br>
…pache#13579) Co-authored-by: mprokopchuk <mprokopchuk@apple.com>
…eployed on (apache#13748) Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>
* markdaown table format fixes * remove superfluent chars --------- Co-authored-by: Daan Hoogland <dahn@apache.org>
…3844) The star history chart is currently broken because GitHub restricts stargazer queries to repository owners only. Switch the badge and link to star-history.dera.page, a token-free alternative. Co-authored-by: John Bampton <jbampton@users.noreply.github.com>
The 3 new buttons added are: - Good first issue - Read the Docs build status - CloudStack website status
…he#12973) * Fix checkRoleEscalation performance and bugs in access checking Replace per-API-command loop (~1,484 DB calls) with batch getApisAllowedToAccount calls using cached role permissions, reducing to ~2 DB calls (or 0 with warm cache). Fix NPE on pde.getAccount(), format string mismatch (3 %s but 4 args), and use cached permissions in DynamicRoleBasedAPIAccessChecker.checkAccess(Account, String). * Add tests for checkRoleEscalation, checkAccess, and getApisAllowedToAccount Add tests for DynamicRoleBasedAPIAccessChecker covering checkAccess(Account, String) and getApisAllowedToAccount including cache verification, admin pass-through, allow/deny filtering, and annotation fallback. Add tests for AccountManagerImpl.checkRoleEscalation covering same permissions, caller superset, escalation detection, empty API list, and multi-checker chaining. * Add debug logging exception * make logging vars consistent to other files * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * fix complation and test * fix mokito UnnecessaryStubbing * fix cachePeriodField illegal arg * fix null test * Fix build * Remove unnecessary stubbings * Improve error message on escalation error * Invalidate cache on create or delete role permissions * Fix for error decoding response --------- Co-authored-by: Aaron Chung <aaron_chung@apple.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Daan Hoogland <dahn@apache.org>
Fixes apache#12693 Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
* guard against stopping stats background threats * stats cleanup test * override annotation, and specic and generic enough catch --------- Co-authored-by: Daan Hoogland <dahn@apache.org>
…expunge VM (apache#13194) * Ensure VM IP is removed from VR DHCP records in dnsmasq.leases after expunge VM This also reverts the PR apache#10183 changes (for apache#10182), in turn resulting in apache#11877. * review changes
Co-authored-by: Bernardo De Marco Gonçalves <bernardomg2004@gmail.com>
… and add tests to cover perm check for proj role permissions
…uding sub-domains and accounts in a domain)
Improves access for deliveries for different account types. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Improves access to LDAP configurations based on the user priviledge. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Only admins should be able to disable 2FA for a user. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
… on RBD (apache#13361) RBD erasure-coded pool support (apache#9808) added handling of the rbd_default_data_pool storage-pool detail to RBDStringBuilder (qemu-img path) and to createPhysicalDisk (blank volumes), but not to createDiskFromTemplateOnRBD. As a result, ROOT volumes created from a template via rados-java rbd.clone()/rbd.create() are created without a data pool: all of their data objects land in the (replicated) metadata pool instead of the erasure-coded data pool, defeating the point of EC and consuming ~3x raw space. Set rbd_default_data_pool on the Rados connection (before connect) in both the same-cluster clone/copy branch and the cross-cluster copy branch of createDiskFromTemplateOnRBD, using the destination pool's detail. librbd then honors it as the default data pool when the new image is created, so template-derived volumes get data_pool set, the same way blank volumes already do.
…storeBackupCommandWrapper (apache#14006) * kvm: detect mount failures and honour the configured timeouts on backup restore Script.executeCommand returns null when the command fails, it does not throw, so the try/catch around the mount and umount of the backup repository could never fire and the return value was discarded. A repository that fails to mount was therefore treated as mounted, and the restore carried on against an empty directory until it failed later with a misleading "backup file not found". A failed umount was ignored the same way, leaking the mount. Both now go through executeCommandForExitValue and check the exit value. The same refactor also dropped the timeouts. mountTimeout was still passed into mountBackupDirectory but never used, and the rsync of the volume lost the command timeout, so both fell back to the one hour default in Script instead of the configured values. An unresponsive repository could hold a restore up for an hour rather than failing after nas.backup.restore.mount.timeout seconds. * kvm: clean up after a failed mount and bound the unmount of a backup repository The directory created for the mount is removed by the caller in a finally block, but that block is only reached once the mount has succeeded, so a repository that cannot be mounted left an empty directory behind on every attempt. It is now removed before the failure is reported, best effort and logged if it cannot be. The unmount ran without a timeout and so fell back to the one hour default in Script. Unmounting a repository that has become unreachable blocks as easily as mounting one, and this runs in the cleanup path of a restore, so it is now bounded by the configured mount timeout like the mount itself.
* storage: enable RBD/Ceph volume encryption support (shared base) Flip StoragePoolType.RBD from EncryptionSupport.Unsupported to Hypervisor so the existing encryption control plane (allocator, endpoint selector, offerings) treats RBD pools as encryption-capable. The agent-side encrypted RBD create path is not implemented yet; it is delivered by two follow-up tracks (qemu-native engine='qemu' and ceph-native engine='librbd'). Until then, fail closed at the two RBD create chokepoints in LibvirtStorageAdaptor (createPhysicalDisk and createDiskFromTemplate) when a passphrase is present, so we never silently produce a plaintext volume that the control plane believes is encrypted. No change for existing unencrypted RBD volumes (guards only fire when a passphrase is set; supportsEncryption() only affects volumes that require encryption). * kvm: Ceph-native LUKS2 encryption for RBD volumes (engine='librbd') Implements encrypted RBD data and root disks using librbd's native LUKS2 encryption, decrypted at runtime by libvirt/qemu via <encryption engine='librbd'>. CloudStack manages the passphrase (existing model). - RbdEncryption: isolated helper wrapping `rbd encryption format luks2`, cephx via --id + keyfile (secret not on the command line), LUKS passphrase via KeyFile. Kept separate so the CLI can later be swapped for a JNA binding (rados-java has no rbd_encryption_format API). - LibvirtStorageAdaptor: create/clone the raw RBD image, then apply `rbd encryption format luks2`; mark the disk LUKS2 so encrypt_format propagates to the volume. Replaces the fail-closed guards. - QemuObject.EncryptFormat: add LUKS2. - LibvirtVMDef: render <encryption format='luks2' engine='librbd'>; the encrypt details now carry an optional engine. - attach (KVMStorageProcessor) and boot (LibvirtComputingResource): set engine='librbd' for RBD-backed encrypted volumes. NOTE: the CoW-clone-then-format path (encrypted root from an unencrypted template) needs live-cluster validation for the parent-grow / usable-size behaviour described in the Ceph image-encryption docs. Builds: api + plugins/hypervisors/kvm (JDK11). * kvm: gate host encryption probe on librbd support for RBD hostSupportsVolumeEncryption() now advertises encryption capability if the host supports EITHER qemu-native LUKS (qemu-img LUKS + cryptsetup) OR librbd native encryption (rbd CLI with the encryption subcommand). Previously a Ceph-only host that lacked cryptsetup would not advertise encryption even though librbd can encrypt RBD volumes. Split into hostSupportsQemuNativeVolumeEncryption() and hostSupportsRbdVolumeEncryption(); kept HOST_VOLUME_ENCRYPTION as the single host-wide flag (documented limitation: not per-pool). * kvm: resize support for librbd-encrypted RBD volumes (#5) Encrypted RBD volumes are encrypted natively by librbd and must be resized with `rbd resize --encryption-passphrase-file` so librbd grows the encrypted payload and keeps the LUKS header consistent. The existing encrypted-resize path (resizeEncryptedQcowFile) uses qemu-img --object secret, which is for qemu-native LUKS and does not fit the librbd LUKS2 layout. - RbdEncryption.resize(): new `rbd resize` wrapper (cephx via --id + keyfile, passphrase via KeyFile, optional --allow-shrink). - LibvirtResizeVolumeCommandWrapper: detect encrypted RBD and route to the rbd resize path, bypassing the libvirt v.resize and qemu-img paths. Snapshot/revert, RBD<->RBD copy, and migration of encrypted RBD volumes need no code changes: they operate on the raw (LUKS-containing) image at the block level, and the destination passphrase secret is already created engine-agnostic in LibvirtPrepareForMigrationCommandWrapper. These still require live validation. Builds: plugins/hypervisors/kvm (JDK11). * kvm: route online resize of encrypted RBD through virsh blockresize For a running VM, an librbd-encrypted RBD volume must be resized in-band by qemu/librbd, not out-of-band by the rbd CLI. Gate the CLI rbd-resize path on !vmIsRunning so: - offline -> `rbd resize --encryption-passphrase-file` (librbd-aware), and - online -> existing NOTIFYONLY path -> virsh blockresize, where qemu's block_resize delegates to librbd to grow the encrypted payload and notify the guest in one step (no passphrase needed; qemu holds the secret). This avoids notify-less out-of-band growth and qemu/librbd size divergence while the image is open. Online behaviour still needs live validation that blockresize resizes the encrypted payload for engine='librbd' disks. * kvm: encrypted RBD root disks (thin CoW clone + full-copy fallback) Root disks could not be encrypted: cloning a plaintext template and then `rbd encryption format`ing the clone leaves the inherited OS data unreadable (the LUKS header offsets it), so the guest could not mount root. Fix, in createDiskFromTemplateOnRBD, with two paths: - Option A (same-cluster cached RBD template): grow the template base to reserve LUKS2 header space, snapshot+protect it (cloudstack-base-snap-luks), clone from it, apply the LUKS2 header, resize the clone to the requested size. Inherited template data stays readable through the clone's encryption and the clone is a thin CoW image (only the header is written). - Option B (first-use / non-RBD template): create an empty image, apply a LUKS2 header, then import the template THROUGH the encryption layer via RbdEncryption.importTemplate (qemu-img convert -n into encrypt.key-secret). Correct but a full copy. Validated end-to-end on Ubuntu 26.04 / libvirt 12.0.0: both boot; A is thin (3.5 GiB provisioned, ~120 MiB used); LUKS2 verified at rest on Ceph. * kvm: harden and align librbd-encrypted RBD volume code Review pass over the librbd LUKS2 encryption feature to fix latent issues and bring it in line with CloudStack conventions: - RbdEncryption: reject empty/null passphrase with a clear error; round rbd --size up to MiB so a non-aligned request never shrinks the volume below what was asked for; create the temporary cephx conf/keyring 0600 explicitly instead of relying on the umask. - LibvirtStorageAdaptor: close Rados/IoCTX/RbdImage in a finally block on the encrypted-root paths (mirrors deleteVolume) so handles are not leaked on exceptions; use parameterized log messages instead of string concatenation; extract the encrypted-root Option A/B logic into createEncryptedRootCoWClone / createEncryptedRootFullCopy. - RbdEncryption: use an instance logger (matching the plugin convention) and split argv construction into build{Format,Resize,Convert}Script so the generated commands can be unit-tested. * kvm: add RbdEncryption unit tests Assert the rbd/qemu-img argv built for format, resize and convert-through-encryption (RBD and file sources), and that empty/null passphrases are rejected. Command construction is verified without a live Ceph cluster. * kvm: refuse encrypted RBD hot-plug on libvirt < 10.1.0 libvirt 10.0.0 has an object apply-order bug (fixed in 10.1.0) that breaks hot-plug of an encrypted rbd blockdev: on attach the disk is opened before its LUKS secret object is defined, so the attach fails with "No secret with id '...-format-encryption-secret0'". Booting a VM from an encrypted RBD disk is unaffected (the QEMU command line resolves all -object before -blockdev). Refuse the attach up front with a clear error (mirroring the existing openvswitch/io_uring libvirt-version gates) instead of letting libvirt fail opaquely. Only the RBD hot-plug path is gated; boot/root/detach are untouched. * docs: add PendingReleaseNotes entry for librbd-encrypted RBD volumes * kvm: route the encrypted RBD template import through QemuImg RbdEncryption built its own 'qemu-img convert' command line, which duplicated qemu-img knowledge outside of QemuImg. QemuImg could only write to a plain filename destination, so importing a template through the librbd encryption layer was not expressible with it. QemuImg now supports a destination described by image options (--target-image-opts, with -n implied since such a target always exists already), exposed as convertIntoExistingTarget(). QemuImageOptions can render its parameters under either image-opts flag. RbdEncryption.importTemplate now composes QemuImageOptions and a QemuObject secret and delegates to QemuImg; its hand-built convert script is removed. The rbd CLI calls (encryption format, resize, support probe) stay, as qemu-img cannot perform them. No functional change to the generated command. * kvm: use readable variable names in the encrypted RBD root helpers Review feedback: single-letter and abbreviated names are hard to read. Renamed in the two methods added by this PR only (renaming the rest of the class is out of scope here): r -> radosConnection, io -> ioContext, rbd -> rbdClient, base -> templateImage, s -> snapshotInfo, encSnap -> luksReservedSnapshotName, haveEncSnap -> luksSnapshotExists, createSize -> imageSizeWithLuksHeader, srcIsRbd -> sourceIsRbdPool. No functional change. * server, kvm: report and require RBD volume encryption separately Review feedback: distinguish the two volume encryption mechanisms instead of advertising them under one host flag. host.volume.encryption goes back to meaning qemu-native LUKS only (qemu-img LUKS + cryptsetup), as it did before this PR, and hosts now additionally report host.volume.encryption.rbd for librbd encryption (rbd encryption format). The deployment planner requires the flag matching the pool type of each encrypted volume - librbd for volumes on RBD pools, qemu-native for any other pool type - at all three places it validated encryption support before. The pool is taken from the pools proposed alongside the host when present, so first deployments are matched accurately too; an encrypted volume with no pool yet accepts either mechanism and the storage pool allocator picks a pool the host can serve. This also stops a host whose librbd is too old for 'rbd encryption format' from being selected for encrypted RBD volumes; it previously advertised encryption through the qemu stack and the VM failed to start. --------- Co-authored-by: Václav Rozsypálek <vaclav.rozsypalek@master.cz> Co-authored-by: calvix <7136358+calvix@users.noreply.github.com>
…he#13877) * feat(backup): incremental NAS backup support for KVM (apache#13074) Implements incremental backup support for the NAS backup provider on KVM, using QEMU dirty bitmaps and libvirt's backup-begin API. RFC: apache#12899. For large VMs this reduces daily backup storage 80–95% and shortens backup windows from hours to minutes (e.g. a 500 GB VM with moderate writes goes from ~500 GB/day to ~5–15 GB/day after the initial full backup). Signed-off-by: James Peru <jmsperu@gmail.com> Co-authored-by: jmsperu <jmsperu@users.noreply.github.com> Co-authored-by: Abhisar Sinha <63767682+abh1sar@users.noreply.github.com> * fix checkstyle * Incremental nas backup fixes (apache#13571) * Avoid concurrent deletes modifying the same backup chain in parallel - Backup deletes are serialized by using a per-VM GlobalLock Backup delete checks if it has a live dependent backup not just a live immediate child. * Fix test failure in NasBackupProviderTest * backup: drop unused backupStatus search condition from listBackups The backupStatus condition was carried over from main, where apache#13254 added a status filter to listBackups. 4.22 has neither ListBackupsCmd.getBackupStatus() nor a setParameters call for it, so the condition is never populated and SearchCriteria.getWhereClause() skips it. Dead code on this branch; the statusNeq clause that hides tombstoned chain members is the one in use. * kvm: execute "qemu-img convert" by Script.executeCommandForExitValue * Add missing return in replaceVolumeWithBackup * make NASBackupFullEvery use NasBackupIncrementalEnabled as the parent * Address review comments: null/empty checks and restore answer guard --------- Signed-off-by: James Peru <jmsperu@gmail.com> Co-authored-by: James Peru Mmbono <jmsperu@gmail.com> Co-authored-by: jmsperu <jmsperu@users.noreply.github.com>
* engine-schema: upgrade path for 24.0.0 Adds a 4.23.0 to 24.0.0 upgrade path. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix CS version Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix upgrade unit tests for cutover Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix imports Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix template version * continue using 3 part version for sys template * fix * fix more * use security version after cutover Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * improvements and add tests Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix more scripts Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address remaining comments Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * more changes Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * Update versioning logic in export-templates.sh Refactor versioning logic to handle four-component metadata separately. Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix export-templates.sh syntax --------- Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com>
… Linstor, plus importVm adoption of existing RBD root volumes and Linstor root/data volumes (apache#13656) Signed-off-by: Andrija Panic <andrija.panic@gmail.com> Co-authored-by: dahn <daan.hoogland@gmail.com>
…/RBD and Linstor, plus importVm adoption of existing RBD root volumes and Linstor root/data volumes (apache#13656)" This reverts commit 0a5bf30.
* Add pre-commit hook to validate dependabot.yml https://check-jsonschema.readthedocs.io/en/stable/precommit_usage.html#check-dependabot python-jsonschema/check-jsonschema@12e6394 * Update regex for dependabot config file validation Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Rename hook for validating dependabot config Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
) * virtual router: Add route-maps to BGP peers for Routed Mode It is best practice, and mandatory in newer version of FRR, that route-maps should be applied to BGP peers. This is to prevent that mistakes can propogate through a network and cause outages. This change changes the route-maps where the VR will only accept IPv4 and IPv4 default gateways (0.0.0.0/0 and ::/0) to be sent by the upstream router to the VR. The other way around this change makes sure that FRR will not allow announcing anything else than the locally defined subnets to the upstream BGP router. * systemvm: ignore comment lines in BGP peer test configuration - Filter comment lines (starting with #) when comparing generated vs expected FRR config - Apply filtering to both generated config and expected config file - Allows keeping license headers in test fixtures while ignoring them in tests - All 11 BGP peer tests pass
* feature: instance boot group and readiness rules Feature to add the concept of instance boot group and readiness rules. Design spec: https://cwiki.apache.org/confluence/spaces/CLOUDSTACK/pages/449282465/Instance+Boot+Group+and+Readiness+Rules Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address review comments Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix ui build Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix vm action warning Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * minor label fixes Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * add tests Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes, address comments Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * remove unused logs Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes and more tests Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * force stop option and smoke test Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * minor config description Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address comments Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address comments; consistent API description Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix failing test Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address missed Copilot review Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * engine-schema: upgrade path for 4.24.0 Adds a 4.23.0 to 4.24.0 upgrade path. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * move schema changes to 4.24, update order column name Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * remove unused rule type from presentation Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * test: fix testRestoreVirtualMachineWhenHostRemoved failure Build was failing with, 18:53:06 [ERROR] Errors: 18:53:06 [ERROR] UserVmManagerImplTest.testRestoreVirtualMachineWhenHostRemoved:1886 ? NullPointer Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix imports Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * add since version for api commands Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fixes around members and ui Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix ui issue on updating readiness rule Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * fix wrong reporting of the attempt count Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * address copilot review Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> * prevent instancegroup vms delete/remove only for one with rules Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> --------- Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com> Co-authored-by: dahn <daan@onecht.net>
* Added basic Develocity integration * Added develocity access key setup to github actions (maven) workflows * Cleanup * Added licensing header to .mvn/extensions.xml * Added lincesing info and .gitignore for develocity integration * Point Develocity at develocity.apache.org Signed-off-by: Gasper Kojek <gkojek@gradle.com> * Bump Develocity Maven extensions and drop unused access key env - develocity-maven-extension 1.21.4 -> 2.5.0 - common-custom-user-data-maven-extension 2.0 -> 2.4.0 CCUD 2.4.0 targets develocity-maven-extension 2.5.0, and both are compatible with the Develocity 2026.2.x server. Verified locally with `mvn -N validate`: both extensions load and the existing .mvn/develocity.xml is read and accepted unchanged. Also drop DEVELOCITY_ACCESS_KEY from ui.yml and pre-commit.yml, which do not run Maven. Signed-off-by: Gasper Kojek <gkojek@gradle.com> * Use the DEVELOCITY_ACCESS_KEY secret name Signed-off-by: Gasper Kojek <gkojek@gradle.com> * Update develocity-maven-extension version to 2.6.0 * Scope DEVELOCITY_ACCESS_KEY to the Maven steps Signed-off-by: Gasper Kojek <gkojek@gradle.com> --------- Signed-off-by: Gasper Kojek <gkojek@gradle.com> Co-authored-by: Gasper Kojek <gkojek@gradle.com>
VMware to KVM: cold (VDDK) and warm (CBT) migration into Ceph/RBD and Linstor, plus importVm adoption of existing RBD and Linstor volumes Restores apache#13656 (merged as 0a5bf30, reverted by 510d0ec), with the fixes found in review: - CBT: the per-disk checkpoint between delta cycles is now read from the cycle snapshot's disk backing, so each delta copies only the changes since the previous cycle (a5578d6) - CBT: failures of the final agent command or of recording the final cycle are handled through the normal cutover failure path (6fa7d30) - CBT: cancel and delete keep the target disks of an imported VM (fd16736) - importVm: load template details from the supplied template, so imports with the removed "VM Import Default Template" work again (port of apache#14195, 2a3598a) - LINSTOR import: resource-group validation against the selected pool, and inspection and listing from controller metadata without connecting or disconnecting local DRBD resources (01058cd); pagination offset/limit order (ce349d8) Feature summary: - warm VMware-to-KVM migration with VDDK and Changed Block Tracking: persisted migration, cycle and disk records, preflight, delta cycles, operator cutover, cancel and cleanup; new admin APIs startVmwareCbtMigration, syncVmwareCbtMigration, cutoverVmwareCbtMigration, cancelVmwareCbtMigration, deleteVmwareCbtMigration, listVmwareCbtMigrations and checkVmwareCbtMigrationPrerequisites; UI under Tools - cold direct VDDK import straight into Ceph/RBD or Linstor (raw), with virt-v2v in-place finalization - adoption of existing RBD and Linstor ROOT (importVm importsource=shared) and DATA (importVolume) volumes without copying - guest OS type, firmware (BIOS/UEFI, secure boot) and console defaults derived from the source VM configuration; static IPv4 preservation; Windows data disks brought online at first boot - database changes in the 4.23.0 to 24.0.0 upgrade path Reviewed and tested: LGTM from rp- (LINSTOR maintainer) and alexandremattioli (tested warm CBT to QCOW2 and Ceph); Trillian smoke tests tid-17130 on 95fc5b5: 157 OK, 0 errors. Signed-off-by: Andrija Panic <andrija.panic@gmail.com>
…/apache-main-oct
piyush5netapp
requested review from
rajiv-jain-netapp,
sandeeplocharla and
suryag1201
as code owners
October 15, 2026 16:11
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| steps: | ||
| - name: Check token liveness | ||
| env: | ||
| TOKEN: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', matrix.name)] }} |
| echo "WARNING: no live Copilot token (rotated or base)" >&2; fi | ||
| env: | ||
| BASE: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| CAND_0: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_0)] }} |
| env: | ||
| BASE: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| CAND_0: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_0)] }} | ||
| CAND_1: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_1)] }} |
| BASE: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| CAND_0: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_0)] }} | ||
| CAND_1: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_1)] }} | ||
| CAND_2: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_2)] }} |
| echo "WARNING: no live Copilot token (rotated or base)" >&2; fi | ||
| env: | ||
| BASE: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| CAND_0: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_0)] }} |
| env: | ||
| BASE: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| CAND_0: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_0)] }} | ||
| CAND_1: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_1)] }} |
| BASE: ${{ secrets.COPILOT_GITHUB_TOKEN }} | ||
| CAND_0: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_0)] }} | ||
| CAND_1: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_1)] }} | ||
| CAND_2: ${{ secrets[format('COPILOT_GITHUB_TOKEN_{0}', steps.names.outputs.name_2)] }} |
…int-cli upgrade (v0.45.0 → v0.49.1)
sandeeplocharla
approved these changes
Oct 15, 2026
sandeeplocharla
left a comment
sandeeplocharla
left a comment
Collaborator
There was a problem hiding this comment.
Does this include the jackson library upgrade also? Or is that PR yet to be merged?
suryag1201
approved these changes
Oct 15, 2026
🔴 Test Coverage Grade:
|
| Metric | Value |
|---|---|
| Line coverage | 25.76% |
| Branch coverage | 20.05% |
Grade Scale
| Grade | Line Coverage | Meaning |
|---|---|---|
| 🟢 A | ≥ 80% | Excellent - this code sleeps well at night 😴 |
| 🟡 B | 60-79% | Good - almost there, don't stop now 😉 |
| 🟠 C | 40-59% | Acceptable - your code is wearing a seatbelt, but no airbags 😬 |
| 🔴 D | 20-39% | Marginal - boldly shipping where no test has gone before 🖖 |
| ⛔ F | < 20% | Failing - tests? what tests? 🔥 |
Branch coverage is shown as a secondary signal. Grade is determined by line coverage.
View full Actions run
Author
No, That is still not merged in apache:main. https://github.com/apache/cloudstack/pull/14297/changes |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR...
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
Bug Severity
Screenshots (if appropriate):
How Has This Been Tested?
How did you try to break this feature and the system with this change?