Skip to content

Management ip address resolution#13603

Open
EduFrazao wants to merge 290 commits into
apache:4.22from
EduFrazao:management_ip_addr_resolution
Open

Management ip address resolution#13603
EduFrazao wants to merge 290 commits into
apache:4.22from
EduFrazao:management_ip_addr_resolution

Conversation

@EduFrazao

@EduFrazao EduFrazao commented Jul 14, 2026

Copy link
Copy Markdown

Description

This PR solves a situation when the management network interface does not have a defined IP address.
When this interface is a bridge, the management ip can be placed directly in the bridge (more common) and sometimes in virtual interfaces linked to it.
On this scenarios, the cloudstack agent iterates over all interfaces and select the first one with a valid ip address.
This brings unpredictable behavior, like choosing wrong interface address, and publishing this address to management servers, causing problems with migrations, guest consoles for example.

I've added two new ways to search for the correct management address:

  • First and more "secure" is to explicitly define the management ip address on agent.properties. The agent will find the interface bound to this address and configure it as private interface.
  • If configuring this address is not desirable, agent will get the management server addresses, and try to establish a socket (without tcp overhead) with it. If it suceeds, will possible to collect the source ip address used to reach management servers. I belive that this is a more assertive way to find out the host management address.
    If the above methods don't work, the actual behavior is used without changes.
  1. Setup a Full L3 network design, with management defined as a traffic label over a "virtual physical address".
  2. Create a bridge and setup a vxlan interface with this bridge as master interface.
  3. Define a veth interface and define the bridge as master for this interface too.
  4. Derfine in this veth interface, the IP address that will be used to reach the management servers.
  5. Theres no guarantee that this will be the IP address reported to the management server.

Fixes: #13519

Types of changes

  • Breaking change (fix or feature that would cause existing functionality to change)
  • New feature (non-breaking change which adds functionality)
  • Bug fix (non-breaking change which fixes an issue)
  • Enhancement (improves an existing feature and functionality)
  • Cleanup (Code refactoring and cleanup, that may add test cases)
  • Build/CI
  • Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

  • Major
  • Minor

Bug Severity

  • BLOCKER
  • Critical
  • Major
  • Minor
  • Trivial

Screenshots (if appropriate):

How Has This Been Tested?

I have two hipervisors in production with this changes. Whitout it, I can't make my cluster to work well, cause I can't do migrations and open guest instances terminal
To test it I used both the explicit configuration and route based detection for several days, marking servers for maintenance, rebooting hypervisors and management servers.

How did you try to break this feature and the system with this change?

Configuring an invalid Ip address as management address. The setting was ignored as expected, because no interface was found with it. System fallback to another methods.

jbampton and others added 30 commits December 16, 2025 14:11
@jbampton
.github: Move dependabot.yml to the correct directory (apache#12243)
53a39d3 
The `dependabot.yml` configuration file should be placed in the `.github` directory at the root of your repository.

Dependabot will not work if the file is placed in any other directory

Minor file extension rename for standardization
@DaanHoogland @shwstppr @sureshanaparti
unlink an ldap domain (apache#11962)
124fcde 
Co-authored-by: Daan Hoogland <dahn@apache.org>
Co-authored-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Co-authored-by: Suresh Kumar Anaparti <sureshkumar.anaparti@gmail.com>
@vishesh92 @DaanHoogland @ShadowJonathan
Github Action: Add action to auto close issues/PRs after a certain ti…
2ac2e5b 
…me (apache#8667)

Co-authored-by: dahn <daan.hoogland@gmail.com>
Co-authored-by: Jonathan de Jong <jonathandejong02@gmail.com>
@dependabot
Bump cs.aws.sdk.version from 1.12.439 to 1.12.795 (apache#12267)
10d76d3
@jbampton
Bump actions/cache to v5 (apache#12247)
e21aacf
@DaanHoogland @Pearl1594
cleanup LDAP code according to warnings (apache#11436)
91376c7 
Co-authored-by: Daan Hoogland <dahn@apache.org>
Co-authored-by: Pearl Dsilva <pearl1594@gmail.com>
@dependabot
Bump org.influxdb:influxdb-java from 2.22 to 2.25 (apache#12270)
28820f6 
Bumps [org.influxdb:influxdb-java](https://github.com/influxdata/influxdb-java) from 2.22 to 2.25.
- [Release notes](https://github.com/influxdata/influxdb-java/releases)
- [Changelog](https://github.com/influxdata/influxdb-java/blob/master/CHANGELOG.md)
- [Commits](influxdata/influxdb-java@influxdb-java-2.22...influxdb-java-2.25)

---
updated-dependencies:
- dependency-name: org.influxdb:influxdb-java
  dependency-version: '2.25'
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
@phsm
security groups: conntrack only if needed (apache#10594)
bb5da0e 
The conntrack is disabled if the security group allows all traffic.
Also, refactored the code a little.
@KlausDornsbach
Log4j2 refactor cloud api module (apache#8728)
13f805f
@viddya673
Feature s390x multiarch support (apache#12214)
558232e 
Signed-off-by: Niyam Siwach <niyam@ibm.com>
Signed-off-by: Viddya K <viddya.k@ibm.com>
Co-authored-by: root <root@c32379v1.fyre.ibm.com>
@dependabot @shwstppr
Bump com.zaxxer:HikariCP from 5.1.0 to 7.0.2 (apache#12266)
eb93f01 
Bumps [com.zaxxer:HikariCP](https://github.com/brettwooldridge/HikariCP) from 5.1.0 to 7.0.2.
- [Changelog](https://github.com/brettwooldridge/HikariCP/blob/dev/CHANGES)
- [Commits](brettwooldridge/HikariCP@HikariCP-5.1.0...HikariCP-7.0.2)

---
updated-dependencies:
- dependency-name: com.zaxxer:HikariCP
  dependency-version: 7.0.2
  dependency-type: direct:production
  update-type: version-update:semver-major
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
Merge release branch 4.22 to main
e2d3773 
* 4.22:
  Update templateConfig.sh to not break with directorys with space on t… (apache#10898)
  Fix VM and volume metrics listing regressions (apache#12284)
  packaging: use latest cmk release link directly (apache#11429)
  api:rename RegisterCmd.java => RegisterUserKeyCmd.java (apache#12259)
  Prioritize copying templates from other secondary storages instead of downloading them (apache#10363)
  Show time correctly in the backup schedule UI  (apache#12012)
  kvm: use preallocation option for fat disk resize (apache#11986)
  Python exception processing static routes fixed (apache#11967)
  KVM memballooning requires free page reporting and autodeflate (apache#11932)
  api: create/register/upload template with empty template tag (apache#12234)
Merge branch '4.22'
22da57f
@sudo87
Cleanup userconcentratedpod_random and userconcentratedpod_firstfit a…
e0c13cc 
…llocation algorithms (apache#12233)

* Cleanup userconcentratedpod_random and userconcentratedpod_firstfit allocation algorithm

* use firstfit instead of random for userconcentratedpod_firstfit
@argusb
Replace deprecated 'egrep' commands with 'grep -E'. (apache#12306)
5bf869c 
Co-authored-by: Sander Grendelman <sander.grendelman@axians.com>
@shwstppr
systemvm-template: support on-demand download during setup and regist…
34b8870 
…ration (apache#11656)

Bundling all hypervisor SystemVM templates in release packages simplifies installs but inflates build time and artifact size. This change enables downloading templates on demand when they’re not found after package installation. The download path is wired into both cloud-setup-management and the existing SystemVM template registration flow.

For connected or mirrored environments, a repository URL prefix can be provided to support air-gapped setups: pass --systemvm-templates-repository <URL-prefix> to cloud-setup-management, or set system.vm.templates.download.repository=<URL-prefix> in server.properties for post-setup registration.

If templates are already present (bundled or preseeded), behavior is unchanged and no download is attempted.

---------

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
@sureshanaparti
Merge branch '4.22'
40d21f0
@Tonitzpp
Removal of internal ID in backup event descriptions (apache#12197)
46cb805
@Tonitzpp
Show volume UUIDs in the backup details page (apache#12156)
81b991a 
Co-authored-by: toni.zamparetti <toni.zamparetti@scclouds.com.br>
@shwstppr
webhook: fixes, filter enhancement (apache#12023)
cd55796 
Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>
@sureshanaparti
Merge branch '4.22'
4628385
@DaanHoogland
Adjust close periods (apache#12376)
c465caf
@shwstppr
Merge remote-tracking branch 'apache/4.22'
eedd329
@jbampton
[CI] Dependabot: add a cooldown period for new releases (apache#12384)
e47d7bc
@jbampton
Standardize and auto add license headers to properties files (apache#…
fd1c67f 
…12231)
@Tonitzpp
Change migration volume exception messages (apache#12367)
bc76f20 
Co-authored-by: toni.zamparetti <toni.zamparetti@scclouds.com.br>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
@erikbocks
Change internal ID to UUID in user disable event (apache#11824)
1ef6365
@he1l0world
Cleanup: Standardize logger message formatting in ApiServer.java (apa…
1b861da 
…che#11188)
Merge branch '4.22'
2811217
@erikbocks @lucas-a-martins
Fixed User type accounts being able to change resource limits of thei…
2358632 
…r own domain and account (apache#12046)

Co-authored-by: Lucas Martins <56271185+lucas-a-martins@users.noreply.github.com>
@EduFrazao

EduFrazao commented Jul 23, 2026

Copy link
Copy Markdown
Author

@DaanHoogland rebase done!
Let me know if there is something more to do!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment