Merge pull request #26277 from lstocchi/i25038

HyperV machine should reuse hvsock registry entries when possible

Author: openshift-merge-bot[bot]

pkg/machine/e2e/init_windows_test.go

@@ -9,6 +9,7 @@ import (
 	"github.com/Microsoft/go-winio/vhd"
 	"github.com/containers/libhvee/pkg/hypervctl"
 	"github.com/containers/podman/v6/pkg/machine/define"
+	"github.com/containers/podman/v6/pkg/machine/hyperv/vsock"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	. "github.com/onsi/gomega/gexec"
@@ -125,4 +126,106 @@ var _ = Describe("podman machine init - windows only", func() {
 		Expect(err).ToNot(HaveOccurred())
 		Expect(checkSession).To(Exit(125))
 	})
+
+	It("init should create hvsock entries if they do not exist, otherwise should reuse existing ones", func() {
+		skipIfNotVmtype(define.HyperVVirt, "HyperV test only")
+
+		name := randomString()
+
+		// Ensure no HVSock entries exist before we start
+		networkHvSocks, err := vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Network)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(networkHvSocks).To(BeEmpty())
+
+		readySocks, err := vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Events)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(readySocks).To(BeEmpty())
+
+		fileServerVsocks, err := vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Fileserver)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(fileServerVsocks).To(BeEmpty())
+
+		// Execute init for the first machine. This should create new HVSock entries
+		i := new(initMachine)
+		session, err := mb.setName(name).setCmd(i.withImage(mb.imagePath)).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(session).To(Exit(0))
+
+		// Check that the HVSock entries were created
+		networkHvSocks, err = vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Network)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(networkHvSocks).To(HaveLen(1))
+
+		readySocks, err = vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Events)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(readySocks).To(HaveLen(1))
+
+		fileServerVsocks, err = vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Fileserver)
+		countFileServerVsocks := len(fileServerVsocks)
+		Expect(err).ToNot(HaveOccurred())
+		// check that many file server vsock was created
+		Expect(countFileServerVsocks).To(BeNumerically(">", 1))
+
+		// Execute init	for another machine. This should reuse the existing HVSock entries created above
+		otherName := randomString()
+		i = new(initMachine)
+		session, err = mb.setName(otherName).setCmd(i.withImage(mb.imagePath)).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(session).To(Exit(0))
+
+		newNetworkHvSocks, err := vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Network)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(newNetworkHvSocks).To(HaveLen(1))
+		Expect(newNetworkHvSocks[0].Port).To(Equal(networkHvSocks[0].Port))
+
+		newReadySocks, err := vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Events)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(newReadySocks).To(HaveLen(1))
+		Expect(newReadySocks[0].Port).To(Equal(readySocks[0].Port))
+
+		newFileServerVsocks, err := vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Fileserver)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(newFileServerVsocks).To(HaveLen(countFileServerVsocks))
+		for i := 0; i < countFileServerVsocks; i++ {
+			Expect(newFileServerVsocks[i].Port).To(Equal(fileServerVsocks[i].Port))
+		}
+
+		// remove first created machine
+		rm := rmMachine{}
+		removeSession, err := mb.setName(name).setCmd(rm.withForce()).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(removeSession).To(Exit(0))
+
+		// Check that HVSock entries still exist after removing one machine
+		networkHvSocks, err = vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Network)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(networkHvSocks).To(HaveLen(1))
+
+		readySocks, err = vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Events)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(readySocks).To(HaveLen(1))
+
+		fileServerVsocks, err = vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Fileserver)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(fileServerVsocks).To(HaveLen(countFileServerVsocks))
+
+		// remove second created machine
+		rm = rmMachine{}
+		removeSession, err = mb.setName(otherName).setCmd(rm.withForce()).run()
+		Expect(err).ToNot(HaveOccurred())
+		Expect(removeSession).To(Exit(0))
+
+		// Verify all hvsock entries created during the test were removed
+		networkHvSocks, err = vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Network)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(networkHvSocks).To(BeEmpty())
+
+		readySocks, err = vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Events)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(readySocks).To(BeEmpty())
+
+		fileServerVsocks, err = vsock.LoadAllHVSockRegistryEntriesByPurpose(vsock.Fileserver)
+		Expect(err).ToNot(HaveOccurred())
+		Expect(fileServerVsocks).To(BeEmpty())
+	})
 })

pkg/machine/hyperv/hutil.go

@@ -0,0 +1,38 @@
+//go:build windows
+
+package hyperv
+
+import (
+	"errors"
+
+	"github.com/sirupsen/logrus"
+	"golang.org/x/sys/windows"
+)
+
+var (
+	ErrHypervUserNotInAdminGroup             = errors.New("Hyper-V machines require Hyper-V admin rights to be managed. Please add the current user to the Hyper-V Administrators group or run Podman as an administrator")
+	ErrHypervRegistryInitRequiresElevation   = errors.New("the first time Podman initializes a Hyper-V machine, it requires admin rights. Please run Podman as an administrator")
+	ErrHypervRegistryRemoveRequiresElevation = errors.New("removing this Hyper-V machine requires admin rights to clean up the Windows Registry. Please run Podman as an administrator")
+	ErrHypervRegistryUpdateRequiresElevation = errors.New("this machine's configuration requires additional Hyper-V networking (hvsock) entries in the Windows Registry. Please run Podman as an administrator")
+)
+
+func HasHyperVAdminRights() bool {
+	sid, err := windows.CreateWellKnownSid(windows.WinBuiltinHyperVAdminsSid)
+	if err != nil {
+		return false
+	}
+
+	//  From MS docs:
+	// "If TokenHandle is NULL, CheckTokenMembership uses the impersonation
+	//  token of the calling thread. If the thread is not impersonating,
+	//  the function duplicates the thread's primary token to create an
+	//  impersonation token."
+	token := windows.Token(0)
+	member, err := token.IsMember(sid)
+	if err != nil {
+		logrus.Warnf("Token Membership Error: %s", err)
+		return false
+	}
+
+	return member
+}