Skip to content

<fix>[compute]: add allowed.tpm.vm.without.kms global config #3661

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
zstack-robot-1 wants to merge 1 commit into from
Closed

<fix>[compute]: add allowed.tpm.vm.without.kms global config #3661

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions compute/src/main/java/org/zstack/compute/vm/VmGlobalConfig.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,4 +139,8 @@ public class VmGlobalConfig {
@GlobalConfigValidation(validValues = {"true", "false"})
@BindResourceConfig(value = {VmInstanceVO.class, ClusterVO.class})
public static GlobalConfig RESET_TPM_AFTER_VM_CLONE = new GlobalConfig(CATEGORY, "reset.tpm.after.vm.clone");

@GlobalConfigDef(defaultValue = "false", type = Boolean.class, description = "allowed TPM VM start without KMS")
@GlobalConfigValidation(validValues = {"true", "false"})
public static GlobalConfig ALLOWED_TPM_VM_WITHOUT_KMS = new GlobalConfig(CATEGORY, "allowed.tpm.vm.without.kms");
}
8 changes: 7 additions & 1 deletion plugin/kvm/src/main/java/org/zstack/kvm/tpm/KvmTpmExtensions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,6 +2,7 @@

import org.apache.commons.lang.StringUtils;
import org.springframework.beans.factory.annotation.Autowired;
import org.zstack.compute.vm.VmGlobalConfig;
import org.zstack.compute.vm.devices.TpmEncryptedResourceKeyBackend;
import org.zstack.core.Platform;
import org.zstack.core.cloudbus.CloudBus;
Expand Down Expand Up @@ -171,7 +172,12 @@ public void fail(ErrorCode errorCode) {

@Override
public boolean skip(Map data) {
return false;
boolean shouldSkip = VmGlobalConfig.ALLOWED_TPM_VM_WITHOUT_KMS.value(Boolean.class) &&
(StringUtils.isBlank(context.providerUuid) || StringUtils.isBlank(context.providerName));
if (shouldSkip) {
logger.info("skip create-dek: allowed.tpm.vm.without.kms is enabled and no KMS provider bound");
}
return shouldSkip;
Comment on lines +175 to +180
Copy link
Copy Markdown

@coderabbitai coderabbitai bot Apr 1, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major

skip 条件过宽，可能误把“已绑定 KMS”当成“无 KMS”放行。

Line 175 当前用 providerUuid/providerName 任一为空就跳过。这样在 providerUuid 已存在但 providerName 暂时为空时，会直接跳过 create-dek，导致 VM 在本应走 KMS 的情况下被放行为无 KMS 启动。

建议修复（收敛为“仅 providerUuid 缺失才跳过”，并与 run 前置校验保持一致） 
@@
-                boolean shouldSkip = VmGlobalConfig.ALLOWED_TPM_VM_WITHOUT_KMS.value(Boolean.class) &&
-                        (StringUtils.isBlank(context.providerUuid) || StringUtils.isBlank(context.providerName));
+                boolean shouldSkip = VmGlobalConfig.ALLOWED_TPM_VM_WITHOUT_KMS.value(Boolean.class) &&
+                        StringUtils.isBlank(context.providerUuid);
                 if (shouldSkip) {
                     logger.info("skip create-dek: allowed.tpm.vm.without.kms is enabled and no KMS provider bound");
                 }
                 return shouldSkip;
@@
-                if (StringUtils.isBlank(context.providerUuid) || StringUtils.isBlank(context.providerName)) {
+                if (StringUtils.isBlank(context.providerUuid)) {
                     trigger.fail(operr("missing TPM resource key binding for tpm[uuid:%s], attachKeyProviderToTpm must run before create-dek", context.tpmUuid));
                     return;
                 }
🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@plugin/kvm/src/main/java/org/zstack/kvm/tpm/KvmTpmExtensions.java` around
lines 175 - 180, 当前的 shouldSkip 判定以任一为空（context.providerUuid 或
context.providerName）就跳过 create-dek，导致当 providerUuid 已存在但 providerName
临时为空时误放行；请将判定收敛为只有 context.providerUuid 为空才跳过（保留 providerName 不参与此 skip
决策），以便与启动前 run 的校验逻辑一致，修改 KvmTpmExtensions 中计算 shouldSkip 的逻辑（参见 shouldSkip 变量与
context.providerUuid / context.providerName）以只基于 providerUuid 为空决定返回 true。

}

@Override
Expand Down