Co-authored-by: Daan Hoogland <[email protected]>

…network cleanup (apache#14527)

…che#14259)

* CSTACKEX-321: when nothing is changed in volume resize wizard directl… (#110)

Calling resizeVolume with the existing volume size still invoked the
storage driver, causing an unnecessary driver resize request for
volumes.
### Description

This PR...
<!--- Describe your changes in DETAIL - And how has behaviour
functionally changed. -->

<!-- For new features, provide link to FS, dev ML discussion etc. -->
<!-- In case of bug fix, the expected and actual behaviours, steps to
reproduce. -->

<!-- When "Fixes: #<id>" is specified, the issue/PR will automatically
be closed when this PR gets merged -->
<!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" -->
<!-- Fixes: # -->

<!---
*******************************************************************************
-->
<!--- NOTE: AUTOMATION USES THE DESCRIPTIONS TO SET LABELS AND PRODUCE
DOCUMENTATION. -->
<!--- PLEASE PUT AN 'X' in only **ONE** box -->
<!---
*******************************************************************************
-->

### Types of changes

- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [X] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)

### Feature/Enhancement Scale or Bug Severity

#### Feature/Enhancement Scale

- [ ] Major
- [ ] Minor

#### Bug Severity

- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [X] Minor
- [ ] Trivial

### Screenshots (if appropriate):
Before Patch API is still called in case of no changes in the wizard:
<img width="1423" height="1034" alt="Screenshot 2026-09-24 at 4 33
33 PM"
src="https://github.com/user-attachments/assets/5480986e-bc79-4bc7-b05c-62077c2cc93e"
/>

actually resizes (IN UI)
<img width="1441" height="638" alt="Screenshot 2026-09-24 at 4 36 00 PM"
src="https://github.com/user-attachments/assets/8430eaa3-947e-41d4-8573-518f7831d7f0"
/>


after the fix Patch api is not called :
<img width="1393" height="1035" alt="Screenshot 2026-09-24 at 4 17
52 PM"
src="https://github.com/user-attachments/assets/b53e1146-560a-437a-9b0c-501be9ec4d76"
/>

Shows success immediately:
<img width="1471" height="728" alt="Screenshot 2026-09-24 at 4 28 37 PM"
src="https://github.com/user-attachments/assets/9cdd57b0-2b1f-4550-9830-46f87c439061"
/>



### How Has This Been Tested?

<!-- Please describe in detail how you tested your changes. -->
<!-- Include details of your testing environment, and the tests you ran
to -->

#### How did you try to break this feature and the system with this
change?

<!-- see how your change affects other areas of the code, etc. -->

<!-- Please read the
[CONTRIBUTING](https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
document -->

* CSTACKEX-341: when disk offering parameter is same as the existing in… (#120)

… volume resize return early

### Description

This PR...
<!--- Describe your changes in DETAIL - And how has behaviour
functionally changed. -->

<!-- For new features, provide link to FS, dev ML discussion etc. -->
<!-- In case of bug fix, the expected and actual behaviours, steps to
reproduce. -->

<!-- When "Fixes: #<id>" is specified, the issue/PR will automatically
be closed when this PR gets merged -->
<!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" -->
<!-- Fixes: # -->

<!---
*******************************************************************************
-->
<!--- NOTE: AUTOMATION USES THE DESCRIPTIONS TO SET LABELS AND PRODUCE
DOCUMENTATION. -->
<!--- PLEASE PUT AN 'X' in only **ONE** box -->
<!---
*******************************************************************************
-->

### Types of changes

- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [X] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)

### Feature/Enhancement Scale or Bug Severity

#### Feature/Enhancement Scale

- [ ] Major
- [X] Minor

#### Bug Severity

- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [X] Minor
- [ ] Trivial

### Screenshots (if appropriate):

### How Has This Been Tested?

In case a newerdiskofferingID is mentioned in API then it updates the
DB.
<img width="1394" height="814" alt="Screenshot 2026-10-13 at 11 53
33 AM"
src="https://github.com/user-attachments/assets/9b4e8249-c639-4d29-8ca4-9431b4f1b6cd"
/>

when same ID is given then it immediately returns.
<img width="1404" height="522" alt="Screenshot 2026-10-13 at 11 53
44 AM"
src="https://github.com/user-attachments/assets/d6d0350c-464b-4644-9470-b8879ebdb48c"
/>


<!-- Please describe in detail how you tested your changes. -->
<!-- Include details of your testing environment, and the tests you ran
to -->

#### How did you try to break this feature and the system with this
change?

<!-- see how your change affects other areas of the code, etc. -->

<!-- Please read the
[CONTRIBUTING](https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
document -->

* Address review comments on upstream PR 14259 on apache/main (#135)

### Description

This PR...
<!--- Describe your changes in DETAIL - And how has behaviour
functionally changed. -->

<!-- For new features, provide link to FS, dev ML discussion etc. -->
<!-- In case of bug fix, the expected and actual behaviours, steps to
reproduce. -->

<!-- When "Fixes: #<id>" is specified, the issue/PR will automatically
be closed when this PR gets merged -->
<!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" -->
<!-- Fixes: # -->

<!---
*******************************************************************************
-->
<!--- NOTE: AUTOMATION USES THE DESCRIPTIONS TO SET LABELS AND PRODUCE
DOCUMENTATION. -->
<!--- PLEASE PUT AN 'X' in only **ONE** box -->
<!---
*******************************************************************************
-->

### Types of changes

- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [X] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [X] Test (unit or integration test code)

### Feature/Enhancement Scale or Bug Severity

#### Feature/Enhancement Scale

- [ ] Major
- [ ] Minor

#### Bug Severity

- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [ ] Minor
- [X] Trivial

### Screenshots (if appropriate):

### How Has This Been Tested?

<!-- Please describe in detail how you tested your changes. -->
<!-- Include details of your testing environment, and the tests you ran
to -->

#### How did you try to break this feature and the system with this
change?

<!-- see how your change affects other areas of the code, etc. -->

<!-- Please read the
[CONTRIBUTING](https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
document -->

---------

Co-authored-by: sandeeplocharla <[email protected]>

buildServiceCapabilityParams is a standalone function, so `this` is
undefined and `this.selectedServiceProviderMap` threw a TypeError
whenever SourceNat was selected, leaving the Add Network Offering form
stuck on OK. Use the selectedServiceProviderMap parameter instead.

…n setup cloudstack agent (apache#13281)

* Do not configure selinux/apparmor when setup cloudstack agent

* do not restore as well

* test: set security_driver to selinux or apparmor

* libvirt: do not set security_driver to none in qemu.conf

* cloudutils: remove securityPolicyConfigUbuntu and securityPolicyConfigRedHat

…13245)

* Fix Prometheus exporter not recognizing ::1 as IPv6 loopback

Normalize IPv6 addresses using InetAddress.getHostAddress() so that
compressed forms like ::1 and full forms like 0:0:0:0:0:0:0:1 are
treated as equivalent when checking the allowed IPs list.

Fixes apache#6714

* prometheus: skip blank/non-IP allowlist entries, avoid DNS, cache parsed list

Fix null volume list in KVM disk-only VM snapshot commands

Populate the inherited volume list from the volume/path pairs so UEFI NVRAM backup can locate the root volume without throwing a NullPointerException.

Update the NVRAM regression test to use a real snapshot command instead of mocking the missing list.

Signed-off-by: Abhishek Kumar <[email protected]>

apache#14507)

…che#13737)

The health check scripts run shell commands with Popen(stdout=PIPE) and
call wait() before reading the pipe. When the command output exceeds the
OS pipe capacity (64 KiB on Linux), the child blocks writing to the full
pipe and the parent blocks in wait() forever. This is the deadlock warned
about in the Python subprocess documentation.

On routers with large iptables rule sets this makes iptables_check.py
hang on every run of the advanced health check. A new stuck process chain
accumulates each advanced-check interval (10 minutes by default) until
the router exhausts memory and swap, keepalived's track script starves,
and the router enters FAULT and reboots. On a 512 MB router this produced
a reboot roughly every 9 hours, and redundant pairs failed together
because their timers are synchronized at creation.

Drain the pipe with communicate() and check returncode instead of calling
wait() with an unread pipe. The same latent pattern is also fixed in
memory_usage_check.py, cpu_usage_check.py and gateways_check.py.

Fixes: apache#13735

* DISK ERROR POLICY FOR KVM HYPERVISORS

  KVM-hosted VM disks had no way to configure libvirt/QEMU's error_policy
  (rerror/werror). Every disk defaulted to QEMU's "report" policy, so any
  I/O error from backing storage -- even a brief, otherwise-recoverable
  one -- was passed straight through to the guest as a real disk error.
  During a planned, successful NFS HA failover (VIP moved in ~6s, well
  within normal client timeouts), this caused a guest's ext4 filesystem
  to abort its journal and remount read-only within 3-4 seconds, long
  before storage-side recovery had a chance to run.

  Adds error_policy as a first-class disk/compute offering attribute,
  following the existing cacheMode plumbing end to end:

  - Schema: new disk_offering.error_policy column (default 'report'),
    added to disk_offering_view/service_offering_view/volume_view.
  - Domain model: DiskOffering.DiskErrorPolicy enum (REPORT, STOP,
    IGNORE, ENOSPACE), getter/setter on DiskOffering/DiskOfferingVO.
  - API: new errorpolicy param on createDiskOffering/updateDiskOffering
    and the compute-offering equivalents, surfaced on
    DiskOfferingResponse/ServiceOfferingResponse.
  - Orchestration: value carried DiskOfferingVO -> VolumeObject ->
    VolumeObjectTO -> hypervisor command.
  - KVM agent: LibvirtVMDef.DiskDef renders error_policy='<value>' on
    the <driver> element, set from the volume's offering in
    KVMStorageProcessor next to the existing cache mode handling.
  - UI: errorpolicy exposed on the Add/Clone Disk Offering and
    Add/Clone Compute Offering forms, defaulting to 'report'.

  Default is 'report' (fully backward compatible); supported on both
  disk and compute offerings, matching cacheMode's precedent. Alerting
  on a long-paused domain is left to operators/monitoring.

  Verified end-to-end with error_policy=stop against a real production
  NFS HA failover and a disk-full/ENOSPC test, on both Linux and
  Windows guests across local, self-hosted NFS, and production-NFS
  storage: VMs pause on the real I/O error and resume cleanly with zero
  data loss. Also identified and documented a related limitation: a
  hard-mounted NFS backend that goes silently unreachable (vs. a real
  I/O error) bypasses this feature entirely, since the guest's I/O just
  hangs rather than erroring -- confirmed protocol-independent across
  NFSv3 and NFSv4.

  Fixes Issue: apache#14366

* Add missing error_policy wiring: VolumeInfo interface, VolumeObject, join DAOs, LibvirtCreateCommandWrapper, LibvirtComputingResource

* Add missing error_policy test coverage and UI translation labels

* Fix error_policy mock matchers in clone integration test and brace nesting in LibvirtVMDef disk rendering

* Address review feedback: drop underscore-prefixed fields, dedup DiskCacheMode/DiskErrorPolicy via shared interface, use IDEMPOTENT_ADD_COLUMN, fix spacing

* Deduplicate DiskErrorPolicy enum: use DiskOffering.DiskErrorPolicy directly in KVM plugin instead of a separate copy

#103) (apache#14220)

…how up in UI

### Description
When resizing a volume, backend API validation errors (e.g. invalid size
value) are silently swallowed and never shown to the user.

This PR...
<!--- Describe your changes in DETAIL - And how has behaviour
functionally changed. -->

File: ui/src/views/storage/ResizeVolume.vue, lines 147–151

The .catch() handler uses this.$notification.error() with a hardcoded
path error.response.data.errorresponse.errortext. However, the
CloudStack API only uses errorresponse as the response key for unknown
commands. For known commands like resizeVolume, it uses the command's
own response name (resizevolumeresponse) as the key. So
error.response.data.errorresponse is always undefined, causing a silent
TypeError that swallows the error entirely.
$notifyError avoids this by using _.findKey() to find errortext
regardless of what the key is named — which is why the same validation
error shows correctly in UpdatePrimaryStorage.vue (which uses
$notifyError) but not in ResizeVolume.vue.


<!-- For new features, provide link to FS, dev ML discussion etc. -->
<!-- In case of bug fix, the expected and actual behaviours, steps to
reproduce. -->

<!-- When "Fixes: #<id>" is specified, the issue/PR will automatically
be closed when this PR gets merged -->
<!-- For addressing multiple issues/PRs, use multiple "Fixes: #<id>" -->
<!-- Fixes: # -->

<!---
*******************************************************************************
-->
<!--- NOTE: AUTOMATION USES THE DESCRIPTIONS TO SET LABELS AND PRODUCE
DOCUMENTATION. -->
<!--- PLEASE PUT AN 'X' in only **ONE** box -->
<!---
*******************************************************************************
-->

### Types of changes

- [ ] Breaking change (fix or feature that would cause existing
functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [X] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] Build/CI
- [ ] Test (unit or integration test code)

### Feature/Enhancement Scale or Bug Severity

#### Feature/Enhancement Scale

- [ ] Major
- [ ] Minor

#### Bug Severity

- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [X] Minor
- [ ] Trivial

### Screenshots (if appropriate):

### How Has This Been Tested?
<img width="1470" height="760" alt="Screenshot 2026-09-16 at 12 30
24 PM"
src="https://github.com/user-attachments/assets/f1d993a9-0a5d-4273-9e43-a0ac4838f355"
/>
<img width="1473" height="827" alt="Screenshot 2026-09-16 at 1 07 53 PM"
src="https://github.com/user-attachments/assets/1c900a1d-4978-43ec-ba9d-62fce2f0aac3"
/>
<img width="1470" height="771" alt="Screenshot 2026-09-16 at 1 08 07 PM"
src="https://github.com/user-attachments/assets/8bcf3fac-5b35-427b-ad26-6fe7588d5a72"
/>
<img width="1473" height="799" alt="Screenshot 2026-09-16 at 1 08 24 PM"
src="https://github.com/user-attachments/assets/d0aea139-8d4d-4620-a7d7-ef294a5335c9"
/>


<!-- Please describe in detail how you tested your changes. -->
<!-- Include details of your testing environment, and the tests you ran
to -->

#### How did you try to break this feature and the system with this
change?

<!-- see how your change affects other areas of the code, etc. -->

<!-- Please read the
[CONTRIBUTING](https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
document -->