Suppress knownConditionTrueFalse false positive in RaftManager::get_leader_endpoint,
cppcheck does not see that members may change while raft_mutex is released.
Remove duplicate entries from cppcheck-suppressions.xml, newer cppcheck (2.22)
aborts with 'suppression already exists'.
Add port mirroring for Virtual Networks using the ovswitch and ovswitch_vxlan drivers, allowing selected VM interfaces to send copies of their traffic to external monitoring tools. Support RSPAN output through a VLAN and GRE or ERSPAN tunnels, including ERSPAN types II and III.
Introduce Virtual Network MIRROR definitions with an automatically assigned MIRROR_ID, NAME, optional DESCRIPTION, and TYPE. Select source interfaces through PORTS, expressed as comma-separated VM_ID:NIC_ID pairs, control traffic direction with DIRECTION (IN, OUT, or BOTH, the default), and optionally filter traffic with VLANS.
Configure RSPAN destinations with OUTPUT_VLAN, and GRE or ERSPAN destinations with REMOTE_IP and optional LOCAL_IP. The local address accepts either an IPv4 address or an interface:<name> reference resolved on each host. ERSPAN adds ERSPAN_TYPE and ERSPAN_KEY, with ERSPAN_INDEX for type II and ERSPAN_HWID for type III. Validate required fields, numeric ranges, and incompatible attribute combinations.
Expose mirror creation, configuration updates, source-port membership changes, and deletion through XML-RPC and gRPC, with Ruby, Java, and Go client support and corresponding onevnet mirror-* commands. Add a Sunstone Port Mirroring tab with creation and editing forms, source-interface selection, configuration review, and mirror details. Require administrative permissions on the Virtual Network and selected source VMs; manage definitions through the dedicated mirror APIs.
Integrate mirror configuration with VM networking operations so host OVS state follows NIC activation, updates, and deactivation, and released NICs are removed from mirror membership. Serialize shared mirror changes under a host lock, apply OVS updates in a single transaction, and clean up unused managed tunnel outputs. Configuration updates preserve source membership, membership changes target affected VMs, and mirrors must have all source ports removed before deletion.
co-authored-by: Alejandro Aizel <aaizel@opennebula.io>
co-authored-by: Daniel Clavijo Coca <dclavijo@opennebula.io>
co-authored-by: Pavel Czerny <pczerny@opennebula.io>
co-authored-by: David Carracedo <dcarracedo@opennebula.io>
Interactive backups were limited to a fixed list of TM drivers in
VirtualMachineDisk::support_interactive(), so third party storage
drivers could not use them, even with a OneBEX exporter of their own.
The TM_MAD_CONF of a driver can now enable them:
INTERACTIVE_BACKUP = "YES" | "NO"
INTERACTIVE_BACKUP_FORMATS = comma separated list of image formats,
empty for all formats
The default oned.conf sets them for the drivers that supported
interactive backups so far. If INTERACTIVE_BACKUP is not set, e.g. with
the oned.conf of a previous release, the former built-in list is used.
Adding an exporter required editing config/environment.rb and
app/helpers.rb, which are overwritten on every upgrade.
OneBEX now loads every file in the exporters directory and each
exporter registers itself with OneBEX::Exporters.register, so a third
party exporter only needs to be installed in remotes/onebex/exporters
(and synced to the hosts). An exporter that fails to load is skipped
instead of breaking the others, and the error is logged when the server
starts.
Signed-off-by: Rene Peinthor <rene.peinthor@linbit.com>
Co-authored-by: Rene Peinthor <rene.peinthor@linbit.com>
The oVirt API server no longer runs under Apache/Passenger but as a
dedicated opennebula-ovirtapi.service on top of Puma (from
opennebula-rubygems), listening on ports 80/443 as oneadmin with
CAP_NET_BIND_SERVICE:
- share/pkgs/services/systemd/opennebula-ovirtapi.service
- etc/ovirtapi-puma.rb: Puma configuration (threads, binds, TLS cert),
installed to /etc/one
- config.ru: the HTTP to HTTPS redirect (except for the PKI resource)
that the Apache vhost used to do is now a Rack middleware
- logs go to /var/log/one/ovirtapi.log, logrotate entry added
The PStore databases are opened thread safe, Puma serves requests from
multiple threads (Passenger used one process per request).
Apache/Passenger only files (apache/, bin/, scripts/configure_apache.sh)
are dropped and config/ is renamed to etc/. Certificate generation is
unchanged.
Allow PCI requests to select an available VF using PF_IFNAME or
PF_ADDRESS. Reserve fixed PCI addresses before PF and generic selectors
to keep availability checks and allocation consistent.
Monitor PF/VF relationships and eswitch mode, refresh PCI network
metadata, and prevent passthrough of PFs with enabled VFs. Preserve
compatibility with older probes.
Expose PF interface selection and VF availability in Sunstone, preserve
selectors when editing templates, and update the host XML schema.
co-authored-by: Victor Hansson <vhansson@opennebula.io>
co-authored-by: Daniel Clavijo Coca <dclavijo@opennebula.io>
The remote scripts directory (former SCRIPTS_REMOTE_DIR) is now fixed
to /var/lib/one-remotes and the configuration attribute is gone. The
old default /var/tmp/one was broken in several ways: /var/tmp content
is aged away by systemd-tmpfiles, the world-writable parent allows
squatting on the directory, and the configurable location was silently
not honored by many drivers, probes and static files (sudoers,
AppArmor, tmpfiles, cron).
- The remotes are synced to /var/lib/one-remotes on the hosts; the
directory is created by the node packages, as it cannot be created
by the unprivileged oneadmin
- The node monitoring DB moves along to /var/lib/one-remotes-db;
it cannot live inside the remotes directory as the sync
(rsync --delete) would remove it. The monitord client migrates
the DB from the legacy location on its first start
- Helpers executed through sudo are installed at a fixed path
(/usr/lib/one/sbin) by the node packages, so they are no longer
executed from an oneadmin-writable location
- Remote hooks (REMOTE = yes) run from /var/lib/one-remotes/hooks.
Hook commands given as an absolute path are executed as-is and
must be updated manually
- Fix remotes sync to run the mkdir on the host: the local shell
interpreted the unquoted ';' and ran it on the frontend instead
- onecfg migrator drops SCRIPTS_REMOTE_DIR from oned.conf and the
stock :remote_hook_base_path from onehem-server.conf
ODS
- Adds reusable GenericController and DocumentController DSLs for REST APIs.
- Extends ODS::Document and document pools with typed attributes, safe partial updates, raw access, dependency resolution, and per-resource locking.
- Adds reusable document capabilities through StateMachine, Errorable, Historyable, and Jobable.
- Introduces a declarative workflow/job framework with lifecycle transitions, recovery, cancellation, failure handling, and ensure actions.
- Adds JobScheduler for concurrent execution, resource exclusion, persisted job recovery, stale-result protection, and cancellation coordination.
- Adds the common ODS::Command executor with structured logging, timeout, environment/workspace handling, and signal-based cancellation.
- Moves shared OpenNebula resource helpers and common validation/serialization logic into ODS.
- Adds common handling for sensitive document attributes and automatic secret redaction.
OneForm
- Migrates providers and provisions to ODS documents and reuses the new ODS controller infrastructure.
- Replaces the previous lifecycle manager with the declarative ProvisionLCM workflow.
- Persists active operations in provisions and supports automatic recovery after service restarts.
- Adds asynchronous operation cancellation and replaces retry with recover.
- Introduces ResourceManager for dependency-aware, idempotent management and reconciliation of OpenNebula resources.
- Updates the provision API with direct REST operations for recovery, cancellation, hosts, public IPs, and deletion.
- Improves sensitive provider data handling, including redacted credentials and permission-aware access.
- Adapts Terraform and Ansible execution to the ODS job system, including persistent Terraform state, isolated workspaces, improved progress/error logs, and cancellation.
- Updates host and public IP management, including batch host deletion and stable UUID-based host reconciliation.
- Adds common host template support for Terraform-discovered hosts, including IM_MAD and VMM_MAD.
- Adds support for common host templates in deployment definitions, including IM_MAD and VMM_MAD, automatically applied to hosts discovered by Terraform.
- Improves driver management, validation, deployment inputs, synchronization, and host templates.
- Updates the Ruby client and the oneform, oneprovider, and oneprovision CLIs to match the new API and lifecycle semantics.
- Adapt current Sunstone API calls. No new features included.
- Adds onedb and onecfg migrations for server and sunstone configuration.
- Updates bundled drivers and Ansible inventory handling to match the new implementation and remove obsolete warnings.
(cherry picked from commit 1eab0b458a16e0dfaedfd9cef923ee9c05b5d61c)
* Critical failures like all arping fails return exit code 1
* Unable to start/stop service prints warning
* Removed sleep in arping loop between -U and -A
Adds new oned.conf parameter to configure oned IP allocation mode.
REUSE_ADDRESS: Reuse the first available address instead of assigning
addresses in round-robin order for internal address ranges.
sudo-rs (default sudo on Ubuntu 26.04+) rejects wildcards inside command
arguments, so the ONE_NETNS entry 'sysctl -w net.ipv4.conf.*.arp_ignore=0'
made the whole alias unparseable and broke all netns sudo commands on the
node (tproxy/OneGate setup failed).
Set net.ipv4.conf.{all,default}.arp_ignore=0 in the namespace before the
veth device is moved in; the device then re-inherits arp_ignore=0 from
conf.default, so the per-device (wildcarded) sysctl is not needed and the
sudoers entry becomes a fixed string accepted by both sudo flavors.
to allow cross-subnet ARP replies.
Network namespaces can inherit strict ARP policies (where arp_ignore is greater than 0) from the host's default configurations. When this strictness is inherited, it breaks cross-subnet ARP resolution. Specifically, the namespace silently drops and fails to reply to the VM's cross-subnet ARP requests for local endpoints, such as the 169.254.16.9.
This PR explicitly loosens the inherited ARP strictness by forcing arp_ignore=0 inside the namespace. By applying this to both all and the specific interface, it guarantees the namespace will successfully reply to the VM's ARP requests for local IPs.
(cherry picked from commit ba242ba963)
Add DISK_IDS as part of the VM backup configuration so backups can target a
subset of eligible VM disks. The configuration parser now normalizes and
validates the list against the VM and resets the incremental chain when the
selected disk set changes.
co-authored-by: Pavel Czerny <pczerny@opennebula.io>
(cherry picked from commit 59c2cac474de545eddd642e03e3caac8fb47c1cc)
This PR adds Group VLAN authorization rules for Virtual Network self-provisioning
through VN Template instantiation and VNET updates derived from a VN Template.
The feature lets administrators define VLAN usage policies at group level. These policies are
evaluated when users instantiate VN Templates or update VNETs that were instantiated from a VN
Template. Direct VNET allocation is not treated as the tenant self-provisioning path; the intended
multi-tenant model is to expose network creation through reservations and VN Template
instantiation, while direct VNET allocation remains an admin-controlled operation.
Group VLAN rules are stored under `VLAN_RULES` as `RULE` vector attributes.
Rule format:
```txt
RULE = [
ID = "5,6,100-200",
SCOPE = "CVLAN",
VNTEMPLATE = "10,20-30"
]
Fields:
- ID: VLAN values allowed by the rule. Supports single values and ranges, comma-separated.
- Examples: "5", "5,6,100-200"
- SCOPE: VLAN attribute scope controlled by the rule.
- Supported scopes: VLAN_ID, OUTER_VLAN_ID, CVLAN, VLAN_TAGGED_ID, ANY
- VNTEMPLATE: optional VN Template IDs where the rule applies.
- Supports single values and ranges, comma-separated.
- -1 or missing value means the rule applies to any VN Template.
Examples:
RULE = [
ID = "100-200",
SCOPE = "VLAN_ID",
VNTEMPLATE = "10"
]
Allows VLAN_ID values from 100 to 200 when instantiating or updating VNETs derived from VN Template
10.
RULE = [
ID = "300,400-450",
SCOPE = "ANY",
VNTEMPLATE = "-1"
]
Allows the listed VLAN IDs/ranges for any supported VLAN scope and any VN Template.
Rules are parsed into an internal structured representation when group VLAN data is loaded or
updated. Each rule is normalized into:
- scope
- VLAN ID ranges
- VN Template ID ranges
This avoids reparsing raw template attributes during authorization checks.
Validation is applied to these input scopes:
- VLAN_ID
- OUTER_VLAN_ID
- CVLAN
- VLAN_TAGGED_ID
VLAN_ID and OUTER_VLAN_ID are validated as single integer values. CVLAN and VLAN_TAGGED_ID accept
range expressions such as 5,6-10.
For each requested VLAN value or range:
1. The input is parsed into one or more test ranges.
2. Rules are scanned for matching scope, including ANY.
3. Rules are filtered by VN Template ID:
- empty/-1 VNTEMPLATE matches all templates
- explicit ranges match only included template IDs
4. A requested range is accepted only if it is fully covered by a single rule range.
5. The check passes when all requested ranges are covered.
Automatic VLAN selection is rejected when the user belongs to a group with VLAN rules matching the
target VN Template, including global rules. This avoids bypassing explicit group VLAN policy
through automatic allocation.
VNETs instantiated from VN Templates now preserve the source VN Template ID as a first-class VNET
attribute:
<VNET>
...
<TEMPLATE_ID>...</TEMPLATE_ID>
...
</VNET>
TEMPLATE_ID = -1 means the VNET was created directly and was not instantiated from a VN Template.
This ID is immutable from user template updates:
- it is removed from the VNET template body on insert/update
- it is serialized as a top-level VNET attribute
- update operations use the stored value to validate VLAN authorization
A database migrator moves legacy TEMPLATE/TEMPLATE_ID values to top-level VNET/TEMPLATE_ID.
The tenant self-provisioning model for VNETs is based on controlled entry points:
- VNET reservations
- VN Template instantiation
Group VLAN authorization is enforced on VN Template instantiation and on updates to VNETs that were
instantiated from a VN Template.
Direct VNET allocation is not considered the tenant-facing self-provisioning path. It should remain
admin-controlled, as unrestricted VNET creation can expose other sensitive network attributes such
as PHYDEV, BRIDGE, and driver-specific configuration in addition to VLAN IDs.
Existing VNETs created from VN Templates may have the source template ID stored inside TEMPLATE/
TEMPLATE_ID. The migration step moves that value to top-level VNET/TEMPLATE_ID and removes it from
the template body.
This PR also updates the AR operations (add/del/update) so tenants can easily managed the VNET instantiations.
Existing directly-created VNETs will have no source VN Template and are treated as TEMPLATE_ID =
-1.
Existing group objects without VLAN rules are initialized with an empty VLAN_RULES section,
preserving current behavior until rules are explicitly configured.
Configuration compatibility:
- VLAN_ID, CVLANS, and AR/VLAN_ID are no longer expected to be handled through generic VNET
restricted attributes for the VN Template instantiation flow.
- OneCfg migration/update handling for configuration files will be addressed separately before
release.
co-authored-by: Pavel Czerny <pczerny@opennebula.io>
co-authored-by: Miguel E. Ruiz <mruiz@opennebula.io>
co-authored-by: dcarracedo <dcarracedo@opennebula.io>
This commit introduces a new backup driver based on an "interactive" server. The purpose is to ease the integration of third-party backup systems so they are able to pull backups/increments from the hypervisors:
- New backup driver
- New OpenNebula Backup Exporter (OneBEX). The REST API supports: status,
export, exporters, blocks, data and finish.
- Initial support for file based virtual disks (incrementals only support CBT)
- Refactor backup_qcow2 to accomodate the new logic
- New restore logic to directly write images to the datastore from the backup service.
Co-authored-by: Ruben S. Montero <rsmontero@opennebula.org>
- Configure Open vSwitch VF representor ports
- Apply VLAN, QinQ, and trunk tagging to representors
- Clear OVS port tags when VLAN_ID is empty on update
- Update monitoring components for the new network support
- Fix non string message driver logging
- #7707, fix update VLAN IDs
co-authored-by: Ruben S. Montero <rsmontero@opennebula.org>
Pavel Czerný