Support ApiServer to enforce POST requests for state changing APIs and requests with timestamps #10899

sureshanaparti · 2025-05-21T12:23:53Z

Description

This PR enables ApiServer to support enforcing POST requests with timestamps for state changing APIs, thought the setting 'enforce.post.requests.and.timestamps' (default: false).

Other related sub-project PRs supporting POST requests:

Need to update the cloudstack-go sdk version in the below sub-projects once the changes in apache/cloudstack-go#107 are merged and the sdk is released.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Tested some VM, Volume operations with setting 'enforce.post.requests.and.timestamps' false and true.

How did you try to break this feature and the system with this change?

sureshanaparti · 2025-05-21T12:24:36Z

@blueorangutan package

blueorangutan · 2025-05-21T12:26:04Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-05-21T13:34:30Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13472

sureshanaparti · 2025-05-21T16:29:19Z

@blueorangutan test

blueorangutan · 2025-05-21T16:30:03Z

@sureshanaparti a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-05-22T08:53:46Z

[SF] Trillian test result (tid-13373)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 56145 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10899-t13373-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

sureshanaparti · 2025-05-23T06:09:03Z

@blueorangutan package

blueorangutan · 2025-05-23T06:10:04Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

codecov · 2025-05-23T06:16:08Z

Codecov Report

❌ Patch coverage is 11.11111% with 64 lines in your changes missing coverage. Please review.
✅ Project coverage is 16.58%. Comparing base (3e3a0c0) to head (a1f2604).
⚠️ Report is 174 commits behind head on main.

Files with missing lines	Patch %	Lines
server/src/main/java/com/cloud/api/ApiServlet.java	8.92%	50 Missing and 1 partial ⚠️
server/src/main/java/com/cloud/api/ApiServer.java	13.33%	13 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #10899   +/-   ##
=========================================
  Coverage     16.58%   16.58%           
  Complexity    13989    13989           
=========================================
  Files          5743     5743           
  Lines        510706   510764   +58     
  Branches      62119    62124    +5     
=========================================
+ Hits          84689    84699   +10     
- Misses       416543   416591   +48     
  Partials       9474     9474

Flag	Coverage Δ
uitests	`3.90% <ø> (+<0.01%)`	⬆️
unittests	`17.47% <11.11%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2025-05-23T07:18:54Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13492

sureshanaparti · 2025-05-23T09:07:53Z

@blueorangutan package

blueorangutan · 2025-05-23T09:10:03Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-05-23T10:37:51Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13493

sureshanaparti · 2025-05-23T15:48:38Z

@blueorangutan package

blueorangutan · 2025-05-23T15:50:04Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-05-23T16:59:50Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13498

borisstoyanov · 2025-05-27T09:43:43Z

@blueorangutan test

blueorangutan · 2025-05-27T09:46:03Z

@borisstoyanov a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-05-28T10:39:34Z

[SF] Trillian test result (tid-13412)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 86433 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10899-t13412-kvm-ol8.zip
Smoke tests completed. 130 look OK, 11 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_nic_secondaryip_add_remove	`Error`	1518.90	test_multipleips_per_nic.py
ContextSuite context=TestNestedVirtualization>:setup	`Error`	0.00	test_nested_virtualization.py
ContextSuite context=TestNetworkACL>:setup	`Error`	0.00	test_network_acl.py
ContextSuite context=TestIpv6Network>:setup	`Error`	0.00	test_network_ipv6.py
test_delete_account	`Error`	1518.17	test_network.py
test_delete_network_while_vm_on_it	`Error`	1.25	test_network.py
test_deploy_vm_l2network	`Error`	1.23	test_network.py
test_l2network_restart	`Error`	2.42	test_network.py
ContextSuite context=TestPortForwarding>:setup	`Error`	3.71	test_network.py
ContextSuite context=TestPublicIP>:setup	`Error`	13.52	test_network.py
test_reboot_router	`Failure`	0.12	test_network.py
test_releaseIP	`Error`	6.71	test_network.py
test_releaseIP_using_IP	`Error`	6.82	test_network.py
ContextSuite context=TestRouterRules>:setup	`Error`	6.93	test_network.py
ContextSuite context=TestSharedNetworkWithConfigDrive>:setup	`Error`	1522.77	test_network.py
ContextSuite context=TestPrivateGwACL>:setup	`Error`	0.00	test_privategw_acl.py
ContextSuite context=TestAdapterTypeForNic>:setup	`Error`	0.00	test_nic_adapter_type.py
ContextSuite context=TestNonStrictAffinityGroups>:setup	`Error`	0.00	test_nonstrict_affinity_group.py
ContextSuite context=TestIsolatedNetworksPasswdServer>:setup	`Error`	0.00	test_password_server.py
ContextSuite context=TestPortForwardingRules>:setup	`Error`	0.00	test_portforwardingrules.py
ContextSuite context=TestProjectSuspendActivate>:setup	`Error`	1530.13	test_projects.py

sureshanaparti · 2025-06-02T03:53:57Z

@blueorangutan package

blueorangutan · 2025-06-02T03:56:04Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

Co-authored-by: Kevin Li <[email protected]>

…rviceTab

sureshanaparti · 2025-07-04T08:34:48Z

@blueorangutan package

blueorangutan · 2025-07-04T08:36:03Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

kiranchavala

LGTM

Enabled the global setting "enforce.post.requests.and.timestamps” to true
Execute some API's like create volume /delete network API
Monitor the network traffic via wireshark and we can see the POST request is enforced

weizhouapache

code lgtm

blueorangutan · 2025-07-04T10:11:36Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14026

sureshanaparti · 2025-07-04T10:51:47Z

@blueorangutan test

blueorangutan · 2025-07-04T10:54:08Z

@sureshanaparti a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-07-05T03:10:48Z

[SF] Trillian test result (tid-13677)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 55487 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10899-t13677-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

shwstppr · 2025-07-07T06:53:04Z

@sureshanaparti On latest main branch,

cloudstack|main ⇒  git --no-pager grep "api(" ui/                                                                                                                                                                                main|⚑32 
ui/src/components/view/ImageDeployInstanceButton.vue:      api(this.imageApi, params).then(json => {
ui/src/components/view/ImageDeployInstanceButton.vue:      api('listZones', { showicon: true, ids: zoneids.join(',') }).then(json => {
ui/src/views/compute/KubernetesAddNodes.vue:        api('listVirtualMachines', {
ui/src/views/compute/KubernetesAddNodes.vue:        api('addNodesToKubernetesCluster', params).then(json => {
ui/src/views/compute/KubernetesRemoveNodes.vue:        api('removeNodesFromKubernetesCluster', params).then(json => {

Also, in

cloudstack|main ⇒  git --no-pager grep "postAPI(" ui/src/components/widgets/InfiniteScrollSelect.vue                                                                                                                             main|⚑32 
ui/src/components/widgets/InfiniteScrollSelect.vue:      postAPI(this.api, params).then(json => {

APIs here are supposed to be list APIs so should it call getAPI?

sureshanaparti · 2025-07-07T13:31:22Z

@shwstppr Below should call postAPI(), rest all - list calls should call getAPI().

ui/src/views/compute/KubernetesAddNodes.vue:        api('addNodesToKubernetesCluster', params).then(json => {
ui/src/views/compute/KubernetesRemoveNodes.vue:        api('removeNodesFromKubernetesCluster', params).then(json => {

rohityadavcloud · 2025-07-14T03:52:31Z

@sureshanaparti or @shwstppr anyone following up on these changes?

…d requests with timestamps (apache#10899) Co-authored-by: Kevin Li <[email protected]>

sureshanaparti changed the base branch from main to 4.20 May 21, 2025 12:24

boring-cyborg bot added component:api component:UI labels May 21, 2025

sureshanaparti added this to the 4.20.2 milestone May 22, 2025

sureshanaparti force-pushed the support-apiserver-to-enforce-post-requests-with-timestamps branch from c1a31a9 to d5bde7c Compare May 23, 2025 08:34

sureshanaparti changed the base branch from 4.20 to main May 23, 2025 08:34

sureshanaparti modified the milestones: 4.20.2, 4.21.0 May 23, 2025

sureshanaparti changed the title ~~[WIP] Support ApiServer to enforce POST requests with timestamps for state changing APIs~~ Support ApiServer to enforce POST requests for state changing APIs and requests with timestamps May 23, 2025

sureshanaparti and others added 9 commits July 4, 2025 14:04

UI changes to use POST requests for state changing APIs

d233aa6

Co-authored-by: Kevin Li <[email protected]>

code improvements

8543de0

UI fixes and changes to use POST requests for state changing APIs

559891e

add verifyoauthcodeandgetuser to get cmd list

cc55e20

UI changes for storage access group apis

1d10bd0

fixes

7ffb32f

update logging for post requests

7276762

UI changes for new api calls

1f3c330

UI changes for new api calls in CreateKubernetesCluster, KubernetesSe…

a1f2604

…rviceTab

sureshanaparti force-pushed the support-apiserver-to-enforce-post-requests-with-timestamps branch from 75107b7 to a1f2604 Compare July 4, 2025 08:34

github-actions bot removed the status:has-conflicts label Jul 4, 2025

kiranchavala approved these changes Jul 4, 2025

View reviewed changes

weizhouapache approved these changes Jul 4, 2025

View reviewed changes

DaanHoogland merged commit 749ddb9 into apache:main Jul 5, 2025
25 of 26 checks passed

github-project-automation bot moved this from In Progress to Done in Apache CloudStack 4.21.0 Jul 5, 2025

DaanHoogland deleted the support-apiserver-to-enforce-post-requests-with-timestamps branch July 5, 2025 13:25

vishesh92 mentioned this pull request Jul 14, 2025

UI fix api in project view #11191

Merged

14 tasks

bernardodemarco mentioned this pull request Jul 15, 2025

UI: Fixes front-end API calls #11205

Closed

12 tasks

dhslove pushed a commit to ablecloud-team/ablestack-cloud that referenced this pull request Jul 16, 2025

Support ApiServer to enforce POST requests for state changing APIs an…

76b997e

…d requests with timestamps (apache#10899) Co-authored-by: Kevin Li <[email protected]>

sureshanaparti mentioned this pull request Jul 30, 2025

[UI] Use GET request method for list API calls #11354

Merged

14 tasks

sureshanaparti added the type:improvement label Aug 8, 2025

Support ApiServer to enforce POST requests for state changing APIs and requests with timestamps #10899

Support ApiServer to enforce POST requests for state changing APIs and requests with timestamps #10899

Uh oh!

Conversation

sureshanaparti commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

sureshanaparti commented May 21, 2025

Uh oh!

blueorangutan commented May 21, 2025

Uh oh!

blueorangutan commented May 21, 2025

Uh oh!

sureshanaparti commented May 21, 2025

Uh oh!

blueorangutan commented May 21, 2025

Uh oh!

blueorangutan commented May 22, 2025

Uh oh!

sureshanaparti commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

codecov bot commented May 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

sureshanaparti commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

sureshanaparti commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

borisstoyanov commented May 27, 2025

Uh oh!

blueorangutan commented May 27, 2025

Uh oh!

blueorangutan commented May 28, 2025

Uh oh!

sureshanaparti commented Jun 2, 2025

Uh oh!

blueorangutan commented Jun 2, 2025

Uh oh!

sureshanaparti commented Jul 4, 2025

Uh oh!

blueorangutan commented Jul 4, 2025

Uh oh!

kiranchavala left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache left a comment

Choose a reason for hiding this comment

Uh oh!

blueorangutan commented Jul 4, 2025

Uh oh!

sureshanaparti commented Jul 4, 2025

Uh oh!

blueorangutan commented Jul 4, 2025

Uh oh!

blueorangutan commented Jul 5, 2025

Uh oh!

Uh oh!

shwstppr commented Jul 7, 2025

Uh oh!

sureshanaparti commented May 21, 2025 •

edited

Loading

codecov bot commented May 23, 2025 •

edited

Loading