Backports (stable-5.21) #14581

Signed-off-by: hamistao <[email protected]> (cherry picked from commit 49024c8)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit 9c11555)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit f461943)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit 36d9b9e)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit 7195052)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit 07751bc)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit db5fdde)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 8c3d9bb)

… possible Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 5782bdf)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit d81ea7d)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit c819c62)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 20a01e1)

…TLS. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 5af95c5)

… types. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit cfc98d2)

… definition. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 3012b75)

Errors while sending the response back to the client shouldn't be considered here since the handler was excecuted successfully and the faulty part could be either the server, network or the client. So here we consider this cases as successes for the metrics. Signed-off-by: hamistao <[email protected]> (cherry picked from commit f9fe65a)

Errors while sending the response back to the client shouldn't be considered here since the handler was excecuted successfully and the faulty part could be either the server, network or the client. So here we consider this cases as successes for the metrics. Signed-off-by: hamistao <[email protected]> (cherry picked from commit e5a8fb6)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit 4ddd5cd)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 58106ba)

This field indicates to the CLI which API to use when adding a remote. If `Identity` is true, then `POST /1.0/auth/identities/tls` will be used. Otherwise, `POST /1.0/certificates` will be used. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 4a9d799)

Whether a new client is being trusted via secret, or if an administrator is adding or updating the certificate directly, the certificate must be signed by the CA if set. Note that this is *not* a security issue, because we validate that client certificates have been signed by the CA when authenticating. This just meant that it was possible for an admin to create a certificate that would be invalid. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit b110809)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit c19cf4b)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit dc78faa)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit a020acc)

On updates or deletions each handler is creating a lifecycle event, notify other members to update their identity cache, and update the members own identity cache. This commit factors out the common behaviours so they can be reused. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 04d6a52)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit bf4e757)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit fc982ab)

Adds the fine-grained TLS identity type to the list of candidate identity types for client authentication. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 7bf1fab)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 4d7c92d)

…ne-grained. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit a468877)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit bdd7aec)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 7ce5231)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit f482166)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit ae83b34)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 707d78e)

Check that TLS identities can delete themselves. Also check that identities cannot delete one another. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit fc3d684)

Projects are not confined to users. Users are confined to projects. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 1df7b41)

Projects are not confined to users. Users are confined to projects. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit bc588bc)

There are no authentication methods for projects. This makes the multi-user LXD daemon section more prominent and linkable. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 1e584bb)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 3938a07)

…rial. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 55a3ea5)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 2e764a0)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit ec0b221)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit b571e6e)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit cabae36)

… volume copy` Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit d077910)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit f86417b)

Unfortunately the notifier is called during database startup before the global config has been loaded, so we need to fall back on loading the offline threshold from the database. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 3982c0d)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 1873780)

Avoid a query when a caller already has NodeInfo. This also makes possible using NotifyAll for a subset of cluster members. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit b71357b)

This allows a hook to get some basic info about the cluster member that it's reaching out to without needing to make an explicit `GetServer` call. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 691b047)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit b6b6283)

This correctly initializes the config so that we can grab cluster.offline_threshold from it during the notify tests. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit a621d66)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit af850cc)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 03f890a)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 6e1bcb7)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 6a1165a)

No longer requires making an http request to the target member to get its name. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 1b59823)

No longer require making an http request to the target member to get its name. I also removed the GetServer during storage pool deletion; it's unclear to me what the purpose of this extra request was; it was introduced in fe0d87f but that commit doesn't provide any context. I'll restore the request if I run into storage-related CI failures. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 71edd8c)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 2555bee)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 71e344c)

memberName implies that this function will work for any cluster member, not just the local one Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 6e1a4f4)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 4860bed)

The instance options docs (doc/reference/instance_options.md) play a little fast and loose with terminology: for integer values of limits.cpu it only refers to "CPU(s)" without specifying vCPU, thread or core. LogicalCPUs from the golang std NumCPU is probably the best fit here. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 8c749a2)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit d62e3b5)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 4040dd8)

This is currently unused but will be utilized for resource reservations Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 4b1042f)

And set the test state's server name when clustered Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 458a730)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit f13e377)

This will allow avoiding a GET /1.0/cluster/members/{name}/state when validating resource reservations, and may be useful for validating future config keys. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit b3ce3ed)

config.Dump() creates and passes back a new map, so there's no need to do it a second time. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 23bd4f3)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit a608e3b)

Covers changes introduced with canonical#14294 Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit fead980)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit edcea63a7604786a9fe5396022f8a5b9cd02560f) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit ea10a89)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit db2a8cd1d136dc2463775b4066245576b7001fe7) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit 16a0ca9)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit 3c886fc6b354f4f07a2b8bba1f798092c7084704) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit 5a2c9c7)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit 5d46fd8efdaf27bba1033e08ddc52b07dac8f964) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit bb2fe4b)

…oAPI Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit 38d7c3087c235d59bf194333c766c975b48c6b3c) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit 9bffd16)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit caa997d50cb785d3c0489be59e46dd67b80b3880) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit 65a4067)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit 06b59879623c03cf3e7c3b7cbd23df5b3ec82467) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit 3bbf11c)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit 8f46deddeeadb68218d942cd8521259e278b241a) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit 2be1d52)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit 8261a78dd1134a7a41e704361b271b328c05388a) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit 740a7f9)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 518148c)

…chines Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 80da1ef)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 487d16a)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 846cec4)

Unless `limits.cpu.pin_strategy` is set to auto, VM CPU auto pinning is disabled Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 411f0c3)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 963006d)

…cuation Signed-off-by: Mark Bolton <[email protected]> (cherry picked from commit 838ee14)

"ToAPI" is also used for the database types (db.Instance), and in that context it implies trips to the database rather than just shuffling fields around. Happy to rename as needed. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit b7d1b5d)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit 7c60b4a520c7554bb4a8103783419ed144e511e1) Signed-off-by: hamistao <[email protected]> License: Apache-2.0 (cherry picked from commit 4139ade)

Signed-off-by: Stéphane Graber <[email protected]> Sponsored-by: https://webdock.io (cherry picked from commit 045926b2d9099b18c4d552601bd4ae4fc9b1e8be) Signed-off-by: Thomas Parrott <[email protected]> License: Apache-2.0 (cherry picked from commit 080df7c)

…e casting to `int64` Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 7eee004)

… use `instancetype.Type` instead of `string` Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 6027e2a)

… `ParseUint32Range` Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 62cfe92)

…g and profile settings Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit f6dc890)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 0f397ed)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 4cc768e)

… in commit job Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 79d0ba5)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 2b7f7ac)

This is taken from: canonical/lxd-ci@3df899b Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit cf05f4c)

Currently we use the db cluster CreateNodeClusterGroup func in clusterGroupsPost and clusterGroupPatch when adding nodes to a cluster group. To make this more consistent with other cluster group API handlers, we now use tx.AddNodeToClusterGroup instead. Signed-off-by: Mark Bolton <[email protected]> (cherry picked from commit 43653a2)

As we now use tx.AddNodeToClusterGroup consistently when adding nodes to a cluster group, we may remove some of the generated db code for the nodes_cluster_groups table. Signed-off-by: Mark Bolton <[email protected]> (cherry picked from commit 2fd10fc)

Signed-off-by: Mark Bolton <[email protected]> (cherry picked from commit 51d51a1)

This at least gets us from `O(n)` queries to `O(1)` (where n is instances). InstanceList does a lot of unnecessary faffing around with profiles that ends up getting thrown out (looks like about 4 queries whose results end up being dropped). Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 6d46fd6)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 41ffd77)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit be1ec61)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 2220cde)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 7fe7737)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit afbd115)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 15591e9)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 458e458)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 5093829)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 07a7c8f)

Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 656bb30)

Fixes canonical#14339 Fixes a regression introduced in canonical#13695 Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 18f4c42)

Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit c48c20a)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit b2dd68e)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit de48dc3)

Also change "id" to "operation" in the log context. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 11bc5a3)

On `POST /1.0/certificates` with a trust_token, the CertificateAddToken operation associated with the token is cancelled regardless of where it is invalid/expired. This commit performs the analogous task for pending TLS identities and removes them if invalid when the token is received. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit effd497)

Signed-off-by: Alexander Mikhalitsyn <[email protected]> (cherry picked from commit d9be050)

In Ubuntu Core environment NVIDIA drivers are distributed as a snap components. So, we can't use hostfs as a source of drivers in this case. Instead, we need to get it through gpu-2404 content interface. All the necessary changes were landed into lxd-pkg-snap while back in a scope of external QEMU snap support [1]. canonical/lxd-pkg-snap#505 [1] Usage example: lxc init ubuntu:noble c1 lxc config device add c1 gpu gpu gputype=physical id=nvidia.com/gpu=0 lxc exec c1 -- nvidia-smi Signed-off-by: Alexander Mikhalitsyn <[email protected]> (cherry picked from commit d14fd33)

Signed-off-by: Alexander Mikhalitsyn <[email protected]> (cherry picked from commit e322dff)

Signed-off-by: Alexander Mikhalitsyn <[email protected]> (cherry picked from commit a267ed1)

Signed-off-by: Alexander Mikhalitsyn <[email protected]> (cherry picked from commit 19f1c10)

Since we would like to prevent the use of one OVN network's volatile IP on another OVN network, we should consider this when retrieving external subnet information during validation. Signed-off-by: Mark Bolton <[email protected]> (cherry picked from commit 4d2e505)

…entifier Adding a GPU with `nvidia.com/gpu=all` was actually not adding any physical card devices. This should fix it. With 'all', we should make the difference between CDI device index that are integer and the ones represented by a UUID that could contain the same cards. For example, these two devices are identical (target the same resources) though not named with the same convention: ``` [ { "name": "0", "containerEdits": { "deviceNodes": [ { "path": "/dev/nvidia0", "hook", "create-symlinks", "--link", "../card1::/var/lib/snapd/hostfs/dev/dri/by-path/pci-0000:01:00.0-card", "hook", "create-symlinks", "--link", "../card1::/var/lib/snapd/hostfs/dev/dri/by-path/pci-0000:01:00.0-card", "--link", "../renderD128::/var/lib/snapd/hostfs/dev/dri/by-path/pci-0000:01:00.0-render" ] }, { "hookName": "createContainer", "path": "/snap/lxd/30921/bin/nvidia-ctk", "args": [ "nvidia-ctk", "hook", "chmod", "--mode", "755", "--path", "/dev/dri" ] } ] } }, { "name": "GPU-8da9a1ee-3495-a369-a73a-b9d8ffbc1220", "containerEdits": { "deviceNodes": [ { "path": "/dev/nvidia0", "hostPath": "/var/lib/snapd/hostfs/dev/nvidia0" }, { "path": "/dev/dri/card1", "hostPath": "/var/lib/snapd/hostfs/dev/dri/card1" }, { "path": "/dev/dri/renderD128", "hostPath": "/var/lib/snapd/hostfs/dev/dri/renderD128" } ], "hooks": [ { "hookName": "createContainer", "path": "/snap/lxd/30921/bin/nvidia-ctk", "args": [ "nvidia-ctk", "hook", "create-symlinks", "--link", "../card1::/var/lib/snapd/hostfs/dev/dri/by-path/pci-0000:01:00.0-card", "--link", "../renderD128::/var/lib/snapd/hostfs/dev/dri/by-path/pci-0000:01:00.0-render" ] }, { "hookName": "createContainer", "path": "/snap/lxd/30921/bin/nvidia-ctk", "args": [ "nvidia-ctk", "hook", "chmod", "--mode", "755", "--path", "/dev/dri" ] } ] } } ] ``` Signed-off-by: Gabriel Mougard <[email protected]> (cherry picked from commit 3c8ae63)

This commit adds `cmpInstanceAllKeys()` to provide all possible instance config keys for `lxc profile set <profile>` completions. Function names and go doc comments have also been reworded for clarity. Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit e36d363)

…lation Signed-off-by: Gabriel Mougard <[email protected]> (cherry picked from commit a2324dc)

Signed-off-by: Mark Bolton <[email protected]> (cherry picked from commit 669fc6f)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit a8f95c5)

…ken is used. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit efb7028)

…identities. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit f20f62d)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 86b65fe)

Consolidate this to a function rather than sprinkling const "global" all over the place. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 2878c2a)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit a586c1f)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 3f49b3a)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit a4b9cfe)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 4b47681)

This records the Raft term & index of the cluster member's global DB in the logs for use during recovery. Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 76c9c9b)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 5e6e651)

Since MicroCloud is GA now Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 9379532)

Signed-off-by: Joel Lau <[email protected]> (cherry picked from commit 4fec134)

Compilation fails on armhf without this change. Signed-off-by: Alexander Mikhalitsyn <[email protected]> (cherry picked from commit ad7cb82)

Signed-off-by: Minae Lee <[email protected]> (cherry picked from commit 4cfee29)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 827aab1)

…error to warning Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit a28082d)

Instead of using a hardcoded NVIDIA driver root path, let's use a recently introduced NVIDIA_DRIVER_ROOT environment variable. Signed-off-by: Alexander Mikhalitsyn <[email protected]> (cherry picked from commit fa50b67)

Signed-off-by: Din Music <[email protected]> (cherry picked from commit fbf993c)

Signed-off-by: Din Music <[email protected]> (cherry picked from commit 3e35eb1)

Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 309f982)

Use 24-hour format instead of 12-hour. Based on comment: canonical@4b26fc2#commitcomment-148595914 Signed-off-by: Din Music <[email protected]> (cherry picked from commit cc38020)

Signed-off-by: Din Music <[email protected]> (cherry picked from commit 3045ddd)

… if the GPU device has been added through the CDI mode Signed-off-by: Gabriel Mougard <[email protected]> (cherry picked from commit 03b8078)

Signed-off-by: David Edler <[email protected]> (cherry picked from commit 6b94626)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit a26caf6)

Signed-off-by: Stéphane Graber <[email protected]> (cherry picked from commit 95ede113e5c51a4958a9384d0615ad5a58f72060) Signed-off-by: Mark Laing <[email protected]> License: Apache-2.0 (cherry picked from commit 5c8f415)

Closes lxc/incus#335 Signed-off-by: Stéphane Graber <[email protected]> (cherry picked from commit a13184bf72f0d5ad69aa12b7e392bc2c2ff2ec93) Signed-off-by: Mark Laing <[email protected]> License: Apache-2.0 (cherry picked from commit 05f6d56)

…uster group. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 0111b79)

Signed-off-by: Stéphane Graber <[email protected]> (cherry picked from commit d9b147fbbc5c4202259107c0332526a4237a68ce) Signed-off-by: Kadin Sayani <[email protected]> License: Apache-2.0 (cherry picked from commit 33dc30a)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit dd62771)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 261083e)

…tity. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 683876d)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit f70b3e4)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit d94fe9f)

…handler. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 28da5de)

This is necessary so that a user can update their own certificate without having `can_edit` on their identity. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 305851b)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 90d3bdb)

…ir fingerprint and metadata. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit afbfb15)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit a58dccc)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 6c8da65)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 0229bbe)

… key. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 0aa02a9)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 560ddbc)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 54b59a9)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit f8d97c5)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 764f253)

This util did not specify the `--auth-type` flag when adding the dummy remote. This caused issues if another LXD is running on the host machine while listening on :8443 with OIDC configured. The `remote add` command would fail and get the OIDC headers, then attempt to start the device authorization grant flow with the IdP configured on the other LXD. With `BROWSER=curl` set for use with the `mini-oidc` test util, it was causing `lxc` to attempt to curl the code verification page. Since we have a simpler and more efficient equivalent in `gen_cert_and_key`, I've opted to remove it instead of setting the `--auth-type` flag to avoid this behaviour. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 84896c2)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 077bb5f)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 8553692)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 3bfe237)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 03dc344)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 3fc7a95)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit b66435f)

Signed-off-by: Minae Lee <[email protected]> (cherry picked from commit 74a4990)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 64377dc)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 6f17147)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit a262fd0)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit bbc85e5)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 668d666)

Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit 5b1e2e0)

Fixes canonical#13453 Signed-off-by: Wesley Hershberger <[email protected]> (cherry picked from commit a7e88b0)

Print all Apport [1] crash reports in case of test failures. https://wiki.ubuntu.com/Apport Signed-off-by: Alexander Mikhalitsyn <[email protected]> (cherry picked from commit a80b942)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 757e46b)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit cbaf1c3)

… convey compatibility with containers and vms Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit e93570a)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 79948f6)

…ix-hotplug` This commit splits the `required` device option into separate metadata descriptions for the `usb` and `unix-hotplug` device, resulting in more accurate descriptions based on device compatibility. Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 405fc81)

…atibility Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 32de1aa)

…patibility Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit bc85891)

…ompatibility Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit c9b5a11)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit b7d8247)

The completion command is a useful tool that includes detailed instructions for setting up completions across shell environments. Most CLI applications don't hide this by default so it's quite intuitive for a user to locate/use this command. Furthermore, the LXD snap completions are only set up for Bash shells. Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 0462930)

Fixes: canonical#1289 Signed-off-by: Stefano Rivera <[email protected]> (cherry picked from commit d098f463f7538a4b332e457bbb5e6ea473ef1536) Signed-off-by: Thomas Parrott <[email protected]> License: Apache-2.0 (cherry picked from commit c311976)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 5e1548c)

Adds instance and storage volume snapshots and backups to the OpenFGA model. These entitlements cannot be assigned to identities, service accounts, or group members. Instead they are inherited from the parent instance or volume. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit fd53341)

…d backups. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 506584d)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 1c84225)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit e9fd600)

The auth.ValidateEntitlement function validates all entitlements that can be granted via the API. Since the new entitlements on snapshots and backups cannot be granted via the API, this check fails. The OpenFGA server will return an error if an invalid query is performed based on it's own understanding of the authorization model. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 4f5ad89)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit aaef11a)

Previously the only entities that had inherited relations were project and server. Now that we are linking instances and storage volumes to their snapshots and backups, the OpenFGADatastore implementation needs to handle these relations. On Read, we can connect a snapshot or backup to its parent instance or storage volume using the information stored in its URL. For example, the storage volume backup URL: /1.0/storage-pools/default/volumes/custom/vol1/backups/backup1?project=project1 is related to its parent: /1.0/storage-pools/default/volumes/custom/vol1?project=project1 via the `storage_volume relation`. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit aef5438)

…tartingWithUser. Previously the only entities that had inherited relations were project and server. Now that we are linking instances and storage volumes to their snapshots and backups, the OpenFGADatastore implementation needs to handle these relations. On ReadStartingWithUser, the function needs to return all backups or snapshots that are related to a parent instance or storage volume. This is used in the `ListObjects` call to the OpenFGA server, which is used by `(auth.Authorizer).GetPermissionChecker`. To do this, I have naively queried for all snapshots or backups in the project, and filtered out those that don't have the correct parent. This keeps the implementation simple and makes use of `GetEntityURLs`, which performs as few queries as possible. Further optimisation may be needed. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 74b1e10)

We can now use the `can_view`, `can_edit`, and `can_delete` entitlements with instance backups and snapshots. We should do this so that our checks more accurately reflect the authorization model. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 3744b5f)

The access handler was performing some logic to determine the location of the storage volume for use in the access check. This was based on whether the storage pool is remote, and if not, the cluster member where the volume is located. This commit removes that logic and adds a "location" field to `storageVolumeDetails` so that it can be used in the handlers. The logic for determining the location is modified to suit the call site. It is only set when the pool is not remote. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit ded532a)

The storage volume snapshot and backup access handlers need to share almost identical logic to the storage volume access handler. Including getting the storage pool, understanding if the storage volume is located on another cluster member, and so forth. This commit parameterises the function so that it can be used by the snapshot and backup entity types as well; creating and checking against the correct URL when called. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 02bfea0)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 90bdff3)

We can now check `can_view`, `can_edit`, and `can_delete` against the backup/snapshot itself. We should do so to more accurately reflect the authorization model. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit e554262)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 44e4a30)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 0d3d40e)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 7e64afd)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit d1e6004)

Sometimes it needs to modify them. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 7bbf30a)

Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit b8fa5e4)

Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 0da14e7)

This runs the panic checker against all currently running LXD daemons. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit e63cf22)

This commit reverts any changes made to the current directory in any test suites. Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 1e72b0e)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 484e2ae)

Signed-off-by: Mark Laing <[email protected]> (cherry picked from commit 9465252)

Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 1492337)

This reverts commit 5ecafb1. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 85712d6)

This reverts commit 0145719. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit dd6a47e)

…ce setting is unset." This reverts commit c7f398d. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 7121a31)

This reverts commit a776a06. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit ca995e0)

This reverts commit 8e6ce55. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 345e9b4)

This reverts commit 42e3526. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit f69629a)

…nstance configuration." This reverts commit 7c83061. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 8125bc7)

This reverts commit 05b7152. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 1380841)

This reverts commit d62691f. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 6d8c8fa)

This reverts commit f98c7ad. Signed-off-by: Thomas Parrott <[email protected]> (cherry picked from commit 6671ca9)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit 1d03270)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit e906c70)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit 4090008)

Signed-off-by: hamistao <[email protected]> (cherry picked from commit d92790d)

Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 27d9504)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit 5bf214f)

Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit bae1f69)

… matching This commit consolidates `unix-hotplug` device matching logic into a new function, `deviceMatch`. Consolidating matching logic prevents inconsistent matching between `Register` and `Start`. Signed-off-by: Kadin Sayani <[email protected]> (cherry picked from commit c2413f2)

This package does NOT come from `ppa:ubuntu-lxc/daily` PPA but from the official archive. Looking at its [filelist](https://packages.ubuntu.com/jammy/amd64/lxc-templates/filelist), it's probably not needed when building LXD. However, it has a dependency on `lxc` which is a virtual package pulling `lxc-utils`. As such, explicitly pull the package we need (`lxc-utils`) and explain why the units are masked before the package shipping them is installed. Signed-off-by: Simon Deziel <[email protected]> (cherry picked from commit 4706f9e)

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Backports (stable-5.21) #14581

Backports (stable-5.21) #14581

Commits on Dec 4, 2024

Backports (stable-5.21) #14581

Are you sure you want to change the base?

Backports (stable-5.21) #14581

Commits on Dec 4, 2024