9:05 a.m.
The new virDomainReloadTlsCertificates API is used to notify domain reload
its certificates without restart, and avoid service interruption.
Currently, only QEMU VNC TLS certificates are supported, but parameters and
flags are also reserved for subsequent scenarios.
Take reload QEMU VNC TLS certificates as an example, we can call:
virDomainReloadTlsCertificates(domain,
VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC,
NULL, 0, 0);
Then the specified QMP message would be send to QEMU:
{"execute": "display-reload", "arguments":{"type":
"vnc", "tls-certs": true}}
Refers:
https://gitlab.com/qemu-project/qemu/-/commit/9cc07651655ee86eca41059f5ea...
This is v3 patch, thanks for Han Han and Michal previous review.
Zheng Yan (4):
qemu_capabilities: Add QEMU_CAPS_DISPLAY_RELOAD
qemu: add new driver API for reload TLS certs
libvirt: Introduce virDomainReloadTlsCertificates API
virsh: Introduce domreload-certs sub command
docs/manpages/virsh.rst | 15 +++++
include/libvirt/libvirt-domain.h | 20 ++++++
src/driver-hypervisor.h | 8 +++
src/libvirt-domain.c | 57 +++++++++++++++++
src/libvirt_public.syms | 5 ++
src/qemu/qemu_capabilities.c | 2 +
src/qemu/qemu_capabilities.h | 1 +
src/qemu/qemu_driver.c | 40 ++++++++++++
src/qemu/qemu_hotplug.c | 17 ++++++
src/qemu/qemu_hotplug.h | 4 ++
src/qemu/qemu_monitor.c | 27 ++++++++
src/qemu/qemu_monitor.h | 3 +
src/qemu/qemu_monitor_json.c | 27 ++++++++
src/qemu/qemu_monitor_json.h | 4 ++
src/remote/remote_driver.c | 1 +
src/remote/remote_protocol.x | 15 ++++-
src/remote_protocol-structs | 10 +++
.../caps_6.0.0.x86_64.xml | 1 +
tools/virsh-domain.c | 61 +++++++++++++++++++
19 files changed, 317 insertions(+), 1 deletion(-)
--
2.25.1
9:05 a.m.
New subject: [PATCH 1/4] qemu_capabilities: Add QEMU_CAPS_DISPLAY_RELOAD
The 'display-reload' QMP command was introduced in QEMU 6.0.0, so we
add a compatible capability to check if target QEMU binary supports it.
{"execute":"display-reload", "arguments":{"type":
"vnc", "tls-certs": true}}
The new QMP refer to:
https://gitlab.com/qemu-project/qemu/-/commit/9cc07651655ee86eca41059f5ea...
Signed-off-by: Zheng Yan <yanzheng759(a)huawei.com>
---
src/qemu/qemu_capabilities.c | 2 ++
src/qemu/qemu_capabilities.h | 1 +
tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml | 1 +
3 files changed, 4 insertions(+)
diff --git a/src/qemu/qemu_capabilities.c b/src/qemu/qemu_capabilities.c
index 43975a39ce..7013ff0265 100644
--- a/src/qemu/qemu_capabilities.c
+++ b/src/qemu/qemu_capabilities.c
@@ -629,6 +629,7 @@ VIR_ENUM_IMPL(virQEMUCaps,
/* 400 */
"compat-deprecated",
"acpi-index",
+ "display-reload",
);
@@ -1174,6 +1175,7 @@ struct virQEMUCapsStringFlags virQEMUCapsCommands[] = {
{ "query-cpu-model-baseline", QEMU_CAPS_QUERY_CPU_MODEL_BASELINE },
{ "query-cpu-model-comparison", QEMU_CAPS_QUERY_CPU_MODEL_COMPARISON },
{ "block-export-add", QEMU_CAPS_BLOCK_EXPORT_ADD },
+ { "display-reload", QEMU_CAPS_DISPLAY_RELOAD },
};
struct virQEMUCapsStringFlags virQEMUCapsMigration[] = {
diff --git a/src/qemu/qemu_capabilities.h b/src/qemu/qemu_capabilities.h
index 122fded494..925be69c53 100644
--- a/src/qemu/qemu_capabilities.h
+++ b/src/qemu/qemu_capabilities.h
@@ -609,6 +609,7 @@ typedef enum { /* virQEMUCapsFlags grouping marker for syntax-check
*/
/* 400 */
QEMU_CAPS_COMPAT_DEPRECATED, /* -compat deprecated-(input|output) is supported */
QEMU_CAPS_ACPI_INDEX, /* PCI device 'acpi-index' property */
+ QEMU_CAPS_DISPLAY_RELOAD, /* 'display-reload' qmp command is supported */
QEMU_CAPS_LAST /* this must always be the last item */
} virQEMUCapsFlags;
diff --git a/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml
b/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml
index df631cf88d..74c084dccd 100644
--- a/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml
+++ b/tests/qemucapabilitiesdata/caps_6.0.0.x86_64.xml
@@ -254,6 +254,7 @@
<flag name='rotation-rate'/>
<flag name='compat-deprecated'/>
<flag name='acpi-index'/>
+ <flag name='display-reload'/>
<version>6000000</version>
<kvmVersion>0</kvmVersion>
<microcodeVersion>43100242</microcodeVersion>
--
2.25.1
9:05 a.m.
New subject: [PATCH 2/4] qemu: add new driver API for reload TLS certs
The 'display-reload' QMP command had been introduced from QEMU 6.0.0:
https://gitlab.com/qemu-project/qemu/-/commit/9cc07651655ee86eca41059f5ea...
TO support the new QMP command, we added a new internal API
'virDrvDomainReloadTlsCertificates' to virHypervisorDriver, and
implemented the qemu driver.
Only QEMU VNC TLS certificates are supported currenly.
Signed-off-by: Zheng Yan <yanzheng759(a)huawei.com>
---
src/driver-hypervisor.h | 8 ++++++++
src/qemu/qemu_driver.c | 40 ++++++++++++++++++++++++++++++++++++
src/qemu/qemu_hotplug.c | 17 +++++++++++++++
src/qemu/qemu_hotplug.h | 4 ++++
src/qemu/qemu_monitor.c | 27 ++++++++++++++++++++++++
src/qemu/qemu_monitor.h | 3 +++
src/qemu/qemu_monitor_json.c | 27 ++++++++++++++++++++++++
src/qemu/qemu_monitor_json.h | 4 ++++
8 files changed, 130 insertions(+)
diff --git a/src/driver-hypervisor.h b/src/driver-hypervisor.h
index d642af8a37..d0d4976441 100644
--- a/src/driver-hypervisor.h
+++ b/src/driver-hypervisor.h
@@ -1410,6 +1410,13 @@ typedef int
int seconds,
unsigned int flags);
+typedef int
+(*virDrvDomainReloadTlsCertificates)(virDomainPtr domain,
+ unsigned int type,
+ virTypedParameterPtr params,
+ int nparams,
+ unsigned int flags);
+
typedef struct _virHypervisorDriver virHypervisorDriver;
/**
@@ -1676,4 +1683,5 @@ struct _virHypervisorDriver {
virDrvDomainAuthorizedSSHKeysSet domainAuthorizedSSHKeysSet;
virDrvDomainGetMessages domainGetMessages;
virDrvDomainStartDirtyRateCalc domainStartDirtyRateCalc;
+ virDrvDomainReloadTlsCertificates domainReloadTlsCertificates;
};
diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c
index c90d52edc0..422a350c65 100644
--- a/src/qemu/qemu_driver.c
+++ b/src/qemu/qemu_driver.c
@@ -20449,6 +20449,45 @@ qemuDomainStartDirtyRateCalc(virDomainPtr dom,
return ret;
}
+static int
+qemuDomainReloadTlsCertificates(virDomainPtr domain,
+ unsigned int type,
+ virTypedParameterPtr params,
+ int nparams,
+ unsigned int flags)
+{
+ int ret = -1;
+ virQEMUDriver *driver = domain->conn->privateData;
+ virDomainObj *vm = qemuDomObjFromDomain(domain);
+
+ if (!vm)
+ goto cleanup;
+
+ virCheckNonNullArgGoto(params, cleanup);
+ if (nparams != 0) {
+ virReportInvalidZeroArg(nparams);
+ goto cleanup;
+ }
+ virCheckFlagsGoto(0, cleanup);
+
+ if (qemuDomainObjBeginJob(driver, vm, QEMU_JOB_MODIFY) < 0)
+ goto cleanup;
+
+ if (!virDomainObjIsActive(vm)) {
+ virReportError(VIR_ERR_OPERATION_INVALID,
+ "%s", _("domain is not running"));
+ goto endjob;
+ }
+
+ ret = qemuDomainReloadTLSCerts(driver, vm, type);
+
+ endjob:
+ qemuDomainObjEndJob(driver, vm);
+
+ cleanup:
+ virDomainObjEndAPI(&vm);
+ return ret;
+}
static virHypervisorDriver qemuHypervisorDriver = {
.name = QEMU_DRIVER_NAME,
@@ -20693,6 +20732,7 @@ static virHypervisorDriver qemuHypervisorDriver = {
.domainAuthorizedSSHKeysSet = qemuDomainAuthorizedSSHKeysSet, /* 6.10.0 */
.domainGetMessages = qemuDomainGetMessages, /* 7.1.0 */
.domainStartDirtyRateCalc = qemuDomainStartDirtyRateCalc, /* 7.2.0 */
+ .domainReloadTlsCertificates = qemuDomainReloadTlsCertificates, /* 7.4.0 */
};
diff --git a/src/qemu/qemu_hotplug.c b/src/qemu/qemu_hotplug.c
index a64cddb9e7..34dc035d73 100644
--- a/src/qemu/qemu_hotplug.c
+++ b/src/qemu/qemu_hotplug.c
@@ -6704,3 +6704,20 @@ qemuDomainSetVcpuInternal(virQEMUDriver *driver,
virBitmapFree(livevcpus);
return ret;
}
+
+int qemuDomainReloadTLSCerts(virQEMUDriverPtr driver,
+ virDomainObjPtr vm,
+ unsigned int type)
+{
+ int ret = -1;
+ qemuDomainObjPrivate *priv = vm->privateData;
+
+ qemuDomainObjEnterMonitor(driver, vm);
+
+ ret = qemuMonitorDisplayReloadTLSCerts(priv->mon, type);
+
+ if (qemuDomainObjExitMonitor(driver, vm) < 0)
+ ret = -1;
+
+ return ret;
+}
diff --git a/src/qemu/qemu_hotplug.h b/src/qemu/qemu_hotplug.h
index df8f76f8d6..411741a688 100644
--- a/src/qemu/qemu_hotplug.h
+++ b/src/qemu/qemu_hotplug.h
@@ -160,3 +160,7 @@ int qemuHotplugAttachDBusVMState(virQEMUDriver *driver,
int qemuHotplugRemoveDBusVMState(virQEMUDriver *driver,
virDomainObj *vm,
qemuDomainAsyncJob asyncJob);
+
+int qemuDomainReloadTLSCerts(virQEMUDriverPtr driver,
+ virDomainObjPtr vm,
+ unsigned int type);
diff --git a/src/qemu/qemu_monitor.c b/src/qemu/qemu_monitor.c
index 1e6f892e08..11f8cc8670 100644
--- a/src/qemu/qemu_monitor.c
+++ b/src/qemu/qemu_monitor.c
@@ -4746,3 +4746,30 @@ qemuMonitorQueryDirtyRate(qemuMonitor *mon,
return qemuMonitorJSONQueryDirtyRate(mon, info);
}
+
+static const char *
+qemuMonitorTLSCertificateTypeToString(unsigned int type)
+{
+ switch (type) {
+ /* for now, only VNC is supported */
+ case VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC:
+ return "vnc";
+ default:
+ virReportError(VIR_ERR_INVALID_ARG,
+ _("unsupported qemu certificate type %u"),
+ type);
+ return NULL;
+ }
+}
+
+int
+qemuMonitorDisplayReloadTLSCerts(qemuMonitorPtr mon, unsigned int type)
+{
+ const char *certType = qemuMonitorTLSCertificateTypeToString(type);
+ if (!certType)
+ return -1;
+
+ QEMU_CHECK_MONITOR(mon);
+
+ return qemuMonitorJSONDisplayReload(mon, certType, true);
+}
diff --git a/src/qemu/qemu_monitor.h b/src/qemu/qemu_monitor.h
index 6a25def78b..f26f92fb51 100644
--- a/src/qemu/qemu_monitor.h
+++ b/src/qemu/qemu_monitor.h
@@ -1496,3 +1496,6 @@ struct _qemuMonitorDirtyRateInfo {
int
qemuMonitorQueryDirtyRate(qemuMonitor *mon,
qemuMonitorDirtyRateInfo *info);
+
+int qemuMonitorDisplayReloadTLSCerts(qemuMonitorPtr mon,
+ unsigned int type);
diff --git a/src/qemu/qemu_monitor_json.c b/src/qemu/qemu_monitor_json.c
index 46aa3330a8..9934613cc2 100644
--- a/src/qemu/qemu_monitor_json.c
+++ b/src/qemu/qemu_monitor_json.c
@@ -9446,3 +9446,30 @@ qemuMonitorJSONQueryDirtyRate(qemuMonitor *mon,
return qemuMonitorJSONExtractDirtyRateInfo(data, info);
}
+
+int qemuMonitorJSONDisplayReload(qemuMonitorPtr mon,
+ const char *type,
+ bool tlsCerts)
+{
+ int ret = -1;
+ virJSONValuePtr reply = NULL;
+ virJSONValuePtr cmd = qemuMonitorJSONMakeCommand("display-reload",
+ "s:type", type,
+ "b:tls-certs", tlsCerts,
+ NULL);
+ if (!cmd)
+ return -1;
+
+ if (qemuMonitorJSONCommand(mon, cmd, &reply) < 0)
+ goto cleanup;
+
+ if (qemuMonitorJSONCheckError(cmd, reply) < 0)
+ goto cleanup;
+
+ ret = 0;
+
+ cleanup:
+ virJSONValueFree(cmd);
+ virJSONValueFree(reply);
+ return ret;
+}
diff --git a/src/qemu/qemu_monitor_json.h b/src/qemu/qemu_monitor_json.h
index 01a3ba25f1..73761d54f8 100644
--- a/src/qemu/qemu_monitor_json.h
+++ b/src/qemu/qemu_monitor_json.h
@@ -706,3 +706,7 @@ qemuMonitorJSONStartDirtyRateCalc(qemuMonitor *mon,
int
qemuMonitorJSONQueryDirtyRate(qemuMonitor *mon,
qemuMonitorDirtyRateInfo *info);
+
+int qemuMonitorJSONDisplayReload(qemuMonitorPtr mon,
+ const char *type,
+ bool tlsCerts);
--
2.25.1
9:05 a.m.
New subject: [PATCH 3/4] libvirt: Introduce virDomainReloadTlsCertificates API
The new virDomainReloadTlsCertificates API is used to notify domain reload
its certificates without restart, and avoid service interruption.
And add remote qemu driver impl for virDrvDomainReloadTlsCertificates.
Currently, only QEMU VNC TLS certificates are supported, but parameters and
flags are also reserved for subsequent scenarios.
Take reload QEMU VNC TLS certificates as an example, we can call:
virDomainReloadTlsCertificates(domain,
VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC,
NULL, 0, 0);
Then the specified QMP message would be send to QEMU:
{"execute": "display-relo "arguments":{"type":
"vnc", "tls-certs": true}}
Signed-off-by: Zheng Yan <yanzheng759(a)huawei.com>
---
include/libvirt/libvirt-domain.h | 20 +++++++++++
src/libvirt-domain.c | 57 ++++++++++++++++++++++++++++++++
src/libvirt_public.syms | 5 +++
src/remote/remote_driver.c | 1 +
src/remote/remote_protocol.x | 15 ++++++++-
src/remote_protocol-structs | 10 ++++++
6 files changed, 107 insertions(+), 1 deletion(-)
diff --git a/include/libvirt/libvirt-domain.h b/include/libvirt/libvirt-domain.h
index e99bfb7654..357d3598a6 100644
--- a/include/libvirt/libvirt-domain.h
+++ b/include/libvirt/libvirt-domain.h
@@ -5152,4 +5152,24 @@ int virDomainStartDirtyRateCalc(virDomainPtr domain,
int seconds,
unsigned int flags);
+/**
+ * virDomainTlsCertificateType:
+ * the used scene of TLS certificates for doamin
+ */
+typedef enum {
+ VIR_DOMAIN_TLS_CERT_GRAPHICS_VNC = 0,
+ VIR_DOMAIN_TLS_CERT_GRAPHICS_SPICE = 1,
+
+# ifdef VIR_ENUM_SENTINELS
+ VIR_DOMAIN_TLS_CERT_LAST
+# endif
+} virDomainTlsCertificateType;
+
+int
+virDomainReloadTlsCertificates(virDomainPtr domain,
+ unsigned int type,
+ virTypedParameterPtr params,
+ int nparams,
+ unsigned int flags);
+
#endif /* LIBVIRT_DOMAIN_H */
diff --git a/src/libvirt-domain.c b/src/libvirt-domain.c
index 42c75f6cc5..f2a8949971 100644
--- a/src/libvirt-domain.c
+++ b/src/libvirt-domain.c
@@ -13218,3 +13218,60 @@ virDomainStartDirtyRateCalc(virDomainPtr domain,
virDispatchError(conn);
return -1;
}
+
+/**
+ * virDomainReloadTlsCertificates:
+ * @domain: a domain object.
+ * @type: a value of virDomainTlsCertificateType
+ * @params: pointer to TLS Certs parameter objects, must be NULL if not used
+ * @nparams: number of TLS Certs parameter objects, must be 0 if not used
+ * @flags: extra flags; not used yet, so callers should always pass 0
+ *
+ * Notify domain reload its certificates with specified 'type'
+ *
+ * Returns 0 in case of success, -1 otherwise.
+ */
+int
+virDomainReloadTlsCertificates(virDomainPtr domain,
+ unsigned int type,
+ virTypedParameterPtr params,
+ int nparams,
+ unsigned int flags)
+{
+ virConnectPtr conn;
+
+ VIR_DOMAIN_DEBUG(domain, "certificate type=%u, params=%p, nparams=%d,
flags=%x",
+ type, params, nparams, flags);
+
+ virResetLastError();
+
+ virCheckDomainReturn(domain, -1);
+ conn = domain->conn;
+ virCheckReadOnlyGoto(conn->flags, error);
+ virCheckNonNegativeArgGoto(nparams, error);
+
+ if (type >= VIR_DOMAIN_TLS_CERT_LAST) {
+ virReportInvalidArg(type,
+ _("type must be less than %d"),
+ VIR_DOMAIN_TLS_CERT_LAST);
+ goto error;
+ }
+
+ if (conn->driver->domainReloadTlsCertificates) {
+ int ret;
+ ret = conn->driver->domainReloadTlsCertificates(domain,
+ type,
+ params,
+ nparams,
+ flags);
+ if (ret < 0)
+ goto error;
+ return ret;
+ }
+
+ virReportUnsupportedError();
+
+ error:
+ virDispatchError(domain->conn);
+ return -1;
+}
diff --git a/src/libvirt_public.syms b/src/libvirt_public.syms
index 5678a13cda..30ff012958 100644
--- a/src/libvirt_public.syms
+++ b/src/libvirt_public.syms
@@ -896,4 +896,9 @@ LIBVIRT_7.3.0 {
virNodeDeviceCreate;
} LIBVIRT_7.2.0;
+LIBVIRT_7.4.0 {
+ global:
+ virDomainReloadTlsCertificates;
+} LIBVIRT_7.3.0;
+
# .... define new API here using predicted next version number ....
diff --git a/src/remote/remote_driver.c b/src/remote/remote_driver.c
index 0c72d69933..0e6e4e3007 100644
--- a/src/remote/remote_driver.c
+++ b/src/remote/remote_driver.c
@@ -8566,6 +8566,7 @@ static virHypervisorDriver hypervisor_driver = {
.domainAuthorizedSSHKeysSet = remoteDomainAuthorizedSSHKeysSet, /* 6.10.0 */
.domainGetMessages = remoteDomainGetMessages, /* 7.1.0 */
.domainStartDirtyRateCalc = remoteDomainStartDirtyRateCalc, /* 7.2.0 */
+ .domainReloadTlsCertificates = remoteDomainReloadTlsCertificates, /* 7.4.0 */
};
static virNetworkDriver network_driver = {
diff --git a/src/remote/remote_protocol.x b/src/remote/remote_protocol.x
index de69704b68..96cc7dd9ea 100644
--- a/src/remote/remote_protocol.x
+++ b/src/remote/remote_protocol.x
@@ -286,6 +286,8 @@ const REMOTE_DOMAIN_AUTHORIZED_SSH_KEYS_MAX = 2048;
/* Upper limit on number of messages */
const REMOTE_DOMAIN_MESSAGES_MAX = 2048;
+/* Upper limit on list of TLS certificate parameters */
+const REMOTE_DOMAIN_RELOAD_TLS_CERT_PARAMETERS_MAX = 16;
/* UUID. VIR_UUID_BUFLEN definition comes from libvirt.h */
typedef opaque remote_uuid[VIR_UUID_BUFLEN];
@@ -3836,6 +3838,12 @@ struct remote_domain_start_dirty_rate_calc_args {
unsigned int flags;
};
+struct remote_domain_reload_tls_certificates_args {
+ remote_nonnull_domain dom;
+ unsigned int type;
+ remote_typed_param params<REMOTE_DOMAIN_RELOAD_TLS_CERT_PARAMETERS_MAX>;
+ unsigned int flags;
+};
/*----- Protocol. -----*/
@@ -6784,6 +6792,11 @@ enum remote_procedure {
* @priority: high
* @acl: node_device:start
*/
- REMOTE_PROC_NODE_DEVICE_CREATE = 430
+ REMOTE_PROC_NODE_DEVICE_CREATE = 430,
+ /**
+ * @generate: both
+ * @acl: domain:write
+ */
+ REMOTE_PROC_DOMAIN_RELOAD_TLS_CERTIFICATES = 431
};
diff --git a/src/remote_protocol-structs b/src/remote_protocol-structs
index 6b46328adc..799a8596ea 100644
--- a/src/remote_protocol-structs
+++ b/src/remote_protocol-structs
@@ -3192,6 +3192,15 @@ struct remote_domain_start_dirty_rate_calc_args {
int seconds;
u_int flags;
};
+struct remote_domain_reload_tls_certificates_args {
+ remote_nonnull_domain dom;
+ u_int type;
+ struct {
+ u_int params_len;
+ remote_typed_param * params_val;
+ } params;
+ u_int flags;
+};
enum remote_procedure {
REMOTE_PROC_CONNECT_OPEN = 1,
REMOTE_PROC_CONNECT_CLOSE = 2,
@@ -3623,4 +3632,5 @@ enum remote_procedure {
REMOTE_PROC_NODE_DEVICE_DEFINE_XML = 428,
REMOTE_PROC_NODE_DEVICE_UNDEFINE = 429,
REMOTE_PROC_NODE_DEVICE_CREATE = 430,
+ REMOTE_PROC_DOMAIN_RELOAD_TLS_CERTIFICATES = 431,
};
--
2.25.1
9:05 a.m.
New subject: [PATCH 4/4] virsh: Introduce domreload-certs sub command
Introduce domreload-certs virsh sub-command to notify domain reload
its specified certificates:
#virsh domreload-certs <domain> --type <type> [--flags <flags>]
Signed-off-by: Zheng Yan <yanzheng759(a)huawei.com>
---
docs/manpages/virsh.rst | 15 ++++++++++
tools/virsh-domain.c | 61 +++++++++++++++++++++++++++++++++++++++++
2 files changed, 76 insertions(+)
diff --git a/docs/manpages/virsh.rst b/docs/manpages/virsh.rst
index ad91cd6356..33a5fdf3c0 100644
--- a/docs/manpages/virsh.rst
+++ b/docs/manpages/virsh.rst
@@ -1738,6 +1738,21 @@ included in the URI. If *--all* is specified, then all show all
possible
graphical displays, for a VM could have more than one graphical displays.
+domreload-certs
+---------------
+
+**Syntax:**
+
+::
+ domreload-certs <domain> --type <type> [--flags <flags>]
+
+Notify an active domain reload its certificates without restart process,
+so it will avoid service interruption. *type* must be one of valid number
+from the virDomainTlsCertificateType enum in case the domain driver binary
+supports it, currently only 0 (means QEMU VNC) was supported. *flags* is a
+reserved parameter and not used yet, must be not specified or just set to 0.
+
+
domfsfreeze
-----------
diff --git a/tools/virsh-domain.c b/tools/virsh-domain.c
index 0825f82522..3907001f5c 100644
--- a/tools/virsh-domain.c
+++ b/tools/virsh-domain.c
@@ -14429,6 +14429,61 @@ cmdDomDirtyRateCalc(vshControl *ctl, const vshCmd *cmd)
return ret;
}
+/**
+ * "domreload-certs" command
+ */
+static const vshCmdInfo info_domreload_certs[] = {
+ {.name = "help",
+ .data = N_("Notify domain reload its certificates")
+ },
+ {.name = "desc",
+ .data = N_("Notify domain reload its certificates with specified
'type'")
+ },
+ {.name = NULL}
+};
+
+static const vshCmdOptDef opts_domreload_certs[] = {
+ VIRSH_COMMON_OPT_DOMAIN_FULL(0),
+ {.name = "type",
+ .type = VSH_OT_INT,
+ .flags = VSH_OFLAG_REQ,
+ .help = N_("domain TLS certificate type, currently only support 0(VNC)")
+ },
+ {.name = "flags",
+ .type = VSH_OT_INT,
+ .help = N_("extern flags, not used yet, so callers should always pass 0")
+ },
+ {.name = NULL}
+};
+
+static bool
+cmdDomReloadCerts(vshControl *ctl, const vshCmd *cmd)
+{
+ virDomainPtr dom;
+ unsigned int type;
+ unsigned int flags = 0;
+ bool ret = false;
+
+ if (!(dom = virshCommandOptDomain(ctl, cmd, NULL)))
+ return ret;
+
+ if (vshCommandOptUInt(ctl, cmd, "type", &type) < 0)
+ goto cleanup;
+
+ if (vshCommandOptUInt(ctl, cmd, "flags", &flags) < 0)
+ goto cleanup;
+
+ /* params and nparams not used yet */
+ if (virDomainReloadTlsCertificates(dom, type, NULL, 0, flags) < 0)
+ goto cleanup;
+
+ ret = true;
+
+ cleanup:
+ virDomainFree(dom);
+ return ret;
+}
+
const vshCmdDef domManagementCmds[] = {
{.name = "attach-device",
@@ -15075,5 +15130,11 @@ const vshCmdDef domManagementCmds[] = {
.info = info_domdirtyrate_calc,
.flags = 0
},
+ {.name = "domreload-certs",
+ .handler = cmdDomReloadCerts,
+ .opts = opts_domreload_certs,
+ .info = info_domreload_certs,
+ .flags = 0
+ },
{.name = NULL}
};
--
2.25.1
1325
days inactive
1325
days old
4 comments
1 participants
participants (1)
-
Zheng Yan