CKS: generate a random UUID as password of CKS user in project by weizhouapache · Pull Request #11639 · apache/cloudstack

weizhouapache · 2025-09-15T11:51:51Z

Description

This PR fixes the password CKS user in project

UuidUtils.first returns only the first part of UUID , which contains 8 letters/digits in total.
If the min length is set to a value more than 8, the CKS cluster cannot be created in project

To be consistent with CKS user in non-project, use UUID instead of first 8 chars of UUID as password of CKS user in project

This fixes #11626

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

weizhouapache · 2025-09-15T11:52:30Z

@blueorangutan package

sureshanaparti

clgtm

blueorangutan · 2025-09-15T11:54:06Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

DaanHoogland

lgtm, but how about when the min pw length is set beyond a UUID length?

codecov · 2025-09-15T11:59:26Z

Codecov Report

❌ Patch coverage is 0% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 16.17%. Comparing base (1948f90) to head (0727b7b).
⚠️ Report is 17 commits behind head on 4.20.

Files with missing lines	Patch %	Lines
...c/main/java/com/cloud/user/AccountManagerImpl.java	0.00%	3 Missing ⚠️
...bernetes/cluster/KubernetesClusterManagerImpl.java	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               4.20   #11639      +/-   ##
============================================
- Coverage     16.17%   16.17%   -0.01%     
+ Complexity    13298    13297       -1     
============================================
  Files          5656     5656              
  Lines        498151   498221      +70     
  Branches      60441    60452      +11     
============================================
- Hits          80589    80581       -8     
- Misses       408591   408671      +80     
+ Partials       8971     8969       -2

Flag	Coverage Δ
uitests	`4.00% <ø> (ø)`
unittests	`17.02% <0.00%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

weizhouapache · 2025-09-15T12:04:50Z

lgtm, but how about when the min pw length is set beyond a UUID length?

then #11626 appears 😆

this is just a quick workaround.
If user enables password policy, update the number of uppercase letters and number of special chars to a non-zero value, CKS will not work. so we need to find a ideal solution later.

generate a more strong password matching the policy, or ignore the password policy for CKS users
refer to #11637 (comment)

DaanHoogland

clgtm ( but a real solution should be created in a call that generates a password from a password policy in the end )

blueorangutan · 2025-09-15T15:08:53Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✔️ debian ✖️ suse15. SL-JID 15014

shwstppr

change looks good but maybe for a complete solution we can bypass PasswordPolicy here. Kubernetes project account is created with System account call context so maybe we can bypass policy validations when System is creating accounts

weizhouapache · 2025-09-17T14:11:39Z

change looks good but maybe for a complete solution we can bypass PasswordPolicy here. Kubernetes project account is created with System account call context so maybe we can bypass policy validations when System is creating accounts

thanks @shwstppr
if I understand correctly, you prefer to the PR #11637 ?

shwstppr · 2025-09-17T14:54:20Z

@weizhouapache best case would have been creating a password compliant to the password policy. But because of regex config it would be difficult and error-prone. Next best is bypassing policy and creating a stronger password (which would never be used though). So I think maybe we keep this usage of complete UUID and then bypass the policy for system created account (which I feel would be more generic than adding a User.Source.CKS)

weizhouapache · 2025-09-17T15:00:08Z

@weizhouapache best case would have been creating a password compliant to the password policy. But because of regex config it would be difficult and error-prone. Next best is bypassing policy and creating a stronger password (which would never be used though). So I think maybe we keep this usage of complete UUID and then bypass the policy for system created account (which I feel would be more generic than adding a User.Source.CKS)

thanks @shwstppr
agree that complete UUID should be secure enough.
User.Source.CKS in #11637 is used to bypass the policy. but you are right, we could just bypass the password policy of all users created by system account. let me see if it is possible

… account

weizhouapache · 2025-09-26T06:50:05Z

@blueorangutan package

blueorangutan · 2025-09-26T06:52:04Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-09-26T08:05:54Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15179

shwstppr

@weizhouapache I've not tested but I guess we didn't need all the changes to pass the caller.
We could use CallContext.getCallingAccount(). KubernetesClusterManager was already using the system callcontext at line 1550

weizhouapache · 2025-09-26T08:49:36Z

@weizhouapache I've not tested but I guess we didn't need all the changes to pass the caller. We could use CallContext.getCallingAccount(). KubernetesClusterManager was already using the system callcontext at line 1550

thanks @shwstppr , good point
let me double check and test it

…y system account" This reverts commit 2493a59.

weizhouapache · 2025-09-26T12:23:20Z

@weizhouapache I've not tested but I guess we didn't need all the changes to pass the caller. We could use CallContext.getCallingAccount(). KubernetesClusterManager was already using the system callcontext at line 1550

reverted the last commit, added a simple check on the caller

tested ok

updated password.policy lengths from 0 to 1
without this PR, when created a CKS cluster in a new project, got an error "User password should contain at least [1] special characters."
with this PR, CKS cluster in project has been created successfully

thanks @shwstppr , good advise

shwstppr

LGTM

shwstppr

LGTM. Tested before and after changes.

Before changes

Changed values for password configs

k8s cluster creation failed

After changes

Account created successfully

k8s cluster created

Tested password restrictions still applied when creating as admin

weizhouapache · 2025-09-30T10:17:21Z

cool, thanks for the testing @shwstppr

weizhouapache · 2025-09-30T10:17:38Z

@blueorangutan package

blueorangutan · 2025-09-30T10:18:04Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-09-30T11:48:35Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 15234

weizhouapache · 2025-09-30T13:21:41Z

@blueorangutan test

blueorangutan · 2025-09-30T13:24:06Z

@weizhouapache a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-10-01T06:07:01Z

[SF] Trillian test result (tid-14487)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 56881 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr11639-t14487-kvm-ol8.zip
Smoke tests completed. 140 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_01_deployVMInSharedNetwork	`Failure`	426.81	test_network.py

weizhouapache · 2025-10-01T06:47:51Z

merging based on approvals and manua test, thanks @shwstppr

…e#11639)

CKS: generate a UUID for CKS user in project

1c0182f

boring-cyborg bot added the component:kubernetes label Sep 15, 2025

weizhouapache requested review from DaanHoogland, shwstppr and sureshanaparti September 15, 2025 11:52

weizhouapache changed the title ~~CKS: generate a UUID for CKS user in project~~ CKS: generate a random UUID as password of CKS user in project Sep 15, 2025

weizhouapache added this to the 4.20.2 milestone Sep 15, 2025

sureshanaparti approved these changes Sep 15, 2025

View reviewed changes

DaanHoogland reviewed Sep 15, 2025

View reviewed changes

weizhouapache mentioned this pull request Sep 15, 2025

CKS: generate a strong random password for CKS user #11637

Closed

14 tasks

DaanHoogland approved these changes Sep 15, 2025

View reviewed changes

weizhouapache linked an issue Sep 15, 2025 that may be closed by this pull request

Creating CKS Cluster on 4.20 fails when using strong password settings #11626

Closed

weizhouapache added the status:needs-testing label Sep 15, 2025

shwstppr reviewed Sep 17, 2025

View reviewed changes

server,cks: skip password policy if create account and user by system…

2493a59

… account

boring-cyborg bot added component:api component:LDAP component:networking labels Sep 26, 2025

shwstppr reviewed Sep 26, 2025

View reviewed changes

weizhouapache added 2 commits September 26, 2025 14:20

Revert "server,cks: skip password policy if create account and user b…

0878f0f

…y system account" This reverts commit 2493a59.

CKS: skip password policy check for cks user in project

0727b7b

shwstppr approved these changes Sep 26, 2025

View reviewed changes

shwstppr reviewed Sep 30, 2025

View reviewed changes

weizhouapache added status:ready-for-merge and removed status:needs-testing labels Sep 30, 2025

weizhouapache merged commit c631d6a into apache:4.20 Oct 1, 2025
25 of 26 checks passed

weizhouapache mentioned this pull request Oct 1, 2025

Creating CKS Cluster on 4.20 fails when using strong password settings #11626

Closed

DaanHoogland deleted the 4.20-cks-project-account-password branch October 1, 2025 07:11

dhslove pushed a commit to ablecloud-team/ablestack-cloud that referenced this pull request Oct 17, 2025

CKS: generate a random UUID as password of CKS user in project (apach…

c30a257

…e#11639)

sandeeplocharla pushed a commit to NetApp/cloudstack that referenced this pull request Oct 21, 2025

CKS: generate a random UUID as password of CKS user in project (apach…

c822028

…e#11639)

Conversation

weizhouapache commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

weizhouapache commented Sep 15, 2025

Uh oh!

sureshanaparti left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Sep 15, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Sep 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

weizhouapache commented Sep 15, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Sep 15, 2025

Uh oh!

shwstppr left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache commented Sep 17, 2025

Uh oh!

shwstppr commented Sep 17, 2025

Uh oh!

weizhouapache commented Sep 17, 2025

Uh oh!

weizhouapache commented Sep 26, 2025

Uh oh!

blueorangutan commented Sep 26, 2025

Uh oh!

blueorangutan commented Sep 26, 2025

Uh oh!

shwstppr left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache commented Sep 26, 2025

Uh oh!

weizhouapache commented Sep 26, 2025

Uh oh!

shwstppr left a comment

Choose a reason for hiding this comment

Uh oh!

shwstppr left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache commented Sep 30, 2025

Uh oh!

weizhouapache commented Sep 30, 2025

Uh oh!

blueorangutan commented Sep 30, 2025

Uh oh!

blueorangutan commented Sep 30, 2025

Uh oh!

weizhouapache commented Sep 30, 2025

Uh oh!

blueorangutan commented Sep 30, 2025

Uh oh!

blueorangutan commented Oct 1, 2025

Uh oh!

weizhouapache commented Oct 1, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

weizhouapache commented Sep 15, 2025 •

edited

Loading

codecov bot commented Sep 15, 2025 •

edited

Loading