Support ApiServer to enforce POST requests for state changing APIs and requests with timestamps #10899

sureshanaparti · 2025-05-21T12:23:53Z

Description

This PR enables ApiServer to support enforcing POST requests with timestamps for state changing APIs, thought the setting 'enforce.post.requests.and.timestamps' (default: false).

Other related sub-project PRs supporting POST requests:

Need to update the cloudstack-go sdk version in the below sub-projects once the changes in apache/cloudstack-go#107 are merged and the sdk is released.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Tested some VM, Volume operations with setting 'enforce.post.requests.and.timestamps' false and true.

How did you try to break this feature and the system with this change?

sureshanaparti · 2025-05-21T12:24:36Z

@blueorangutan package

blueorangutan · 2025-05-21T12:26:04Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-05-21T13:34:30Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13472

sureshanaparti · 2025-05-21T16:29:19Z

@blueorangutan test

blueorangutan · 2025-05-21T16:30:03Z

@sureshanaparti a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-05-22T08:53:46Z

[SF] Trillian test result (tid-13373)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 56145 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10899-t13373-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

sureshanaparti · 2025-05-23T06:09:03Z

@blueorangutan package

blueorangutan · 2025-05-23T06:10:04Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

codecov · 2025-05-23T06:16:08Z

Codecov Report

Attention: Patch coverage is 11.11111% with 64 lines in your changes missing coverage. Please review.

Project coverage is 16.58%. Comparing base (3e3a0c0) to head (a1f2604).
Report is 2 commits behind head on main.

Files with missing lines	Patch %	Lines
server/src/main/java/com/cloud/api/ApiServlet.java	8.92%	50 Missing and 1 partial ⚠️
server/src/main/java/com/cloud/api/ApiServer.java	13.33%	13 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #10899   +/-   ##
=========================================
  Coverage     16.58%   16.58%           
  Complexity    13989    13989           
=========================================
  Files          5743     5743           
  Lines        510706   510764   +58     
  Branches      62119    62124    +5     
=========================================
+ Hits          84689    84699   +10     
- Misses       416543   416591   +48     
  Partials       9474     9474

Flag	Coverage Δ
uitests	`3.90% <ø> (+<0.01%)`	⬆️
unittests	`17.47% <11.11%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2025-05-23T07:18:54Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13492

sureshanaparti · 2025-05-23T09:07:53Z

@blueorangutan package

blueorangutan · 2025-05-23T09:10:03Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-05-23T10:37:51Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13493

sureshanaparti · 2025-05-23T15:48:38Z

@blueorangutan package

blueorangutan · 2025-05-23T15:50:04Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-05-23T16:59:50Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13498

borisstoyanov · 2025-05-27T09:43:43Z

@blueorangutan test

blueorangutan · 2025-05-27T09:46:03Z

@borisstoyanov a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-05-28T10:39:34Z

[SF] Trillian test result (tid-13412)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 86433 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10899-t13412-kvm-ol8.zip
Smoke tests completed. 130 look OK, 11 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_nic_secondaryip_add_remove	`Error`	1518.90	test_multipleips_per_nic.py
ContextSuite context=TestNestedVirtualization>:setup	`Error`	0.00	test_nested_virtualization.py
ContextSuite context=TestNetworkACL>:setup	`Error`	0.00	test_network_acl.py
ContextSuite context=TestIpv6Network>:setup	`Error`	0.00	test_network_ipv6.py
test_delete_account	`Error`	1518.17	test_network.py
test_delete_network_while_vm_on_it	`Error`	1.25	test_network.py
test_deploy_vm_l2network	`Error`	1.23	test_network.py
test_l2network_restart	`Error`	2.42	test_network.py
ContextSuite context=TestPortForwarding>:setup	`Error`	3.71	test_network.py
ContextSuite context=TestPublicIP>:setup	`Error`	13.52	test_network.py
test_reboot_router	`Failure`	0.12	test_network.py
test_releaseIP	`Error`	6.71	test_network.py
test_releaseIP_using_IP	`Error`	6.82	test_network.py
ContextSuite context=TestRouterRules>:setup	`Error`	6.93	test_network.py
ContextSuite context=TestSharedNetworkWithConfigDrive>:setup	`Error`	1522.77	test_network.py
ContextSuite context=TestPrivateGwACL>:setup	`Error`	0.00	test_privategw_acl.py
ContextSuite context=TestAdapterTypeForNic>:setup	`Error`	0.00	test_nic_adapter_type.py
ContextSuite context=TestNonStrictAffinityGroups>:setup	`Error`	0.00	test_nonstrict_affinity_group.py
ContextSuite context=TestIsolatedNetworksPasswdServer>:setup	`Error`	0.00	test_password_server.py
ContextSuite context=TestPortForwardingRules>:setup	`Error`	0.00	test_portforwardingrules.py
ContextSuite context=TestProjectSuspendActivate>:setup	`Error`	1530.13	test_projects.py

sureshanaparti · 2025-06-02T03:53:57Z

@blueorangutan package

blueorangutan · 2025-06-02T03:56:04Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

Copilot

Pull Request Overview

This PR enforces POST requests (with timestamps) for state-changing APIs in ApiServer when the enforce.post.requests.and.timestamps setting is enabled, and updates both tests and UI components accordingly.

Replace all api(…) calls with getAPI(…) for read-only, and postAPI(…) for state-changing operations
Update unit tests to use common.createDataParams and POST methods instead of URLSearchParams + GET
Introduce createDataParams helper in ui/tests/common/index.js to build request bodies

Reviewed Changes

Copilot reviewed 261 out of 261 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
ui/tests/common/index.js	Added `createDataParams` helper for building POST body params
ui/tests/unit/views/compute/MigrateWizard.spec.js	Updated tests to expect POST + `common.createDataParams`
ui/tests/unit/views/AutogenView.spec.js	Updated tests to expect POST + `common.createDataParams`
ui/tests/unit/components/view/ActionButton.spec.js	Updated tests to expect POST + `common.createDataParams`
(many) `ui/src/views/.../*.vue`	Switched imports from `api` to `getAPI`/`postAPI` and updated calls

Comments suppressed due to low confidence (3)

ui/tests/unit/components/view/ActionButton.spec.js:154

The test references common.createDataParams but common is not imported at the top of this spec file. Add an import, e.g. import common from '@/tests/common'.

          data: common.createDataParams({

ui/tests/unit/views/compute/MigrateWizard.spec.js:349

This spec uses common.createDataParams but there is no common import shown. Ensure common is imported (e.g. import common from '@/tests/common').

          data: common.createDataParams({

ui/tests/unit/views/AutogenView.spec.js:578

Make sure common is imported in this spec file so common.createDataParams is defined.

          data: common.createDataParams({

shwstppr

For UI it could be smaller, simpler change

shwstppr · 2025-07-01T06:27:17Z

ui/src/api/index.js

@@ -23,18 +23,10 @@ import {
  ACCESS_TOKEN
 } from '@/store/mutation-types'

-export function api (command, args = {}, method = 'GET', data = {}) {


@sureshanaparti wouldn't it be easier to refactor this method itself to enforce use of POST/GET based on configuration/API type? We won't have to modify each caller in that case. Current change will cause merge conflicts for almost all UI related active PRs.

will check it @shwstppr

@shwstppr As discussed offline, the api method is refactored to smaller, separate functions to handle GET & POST calls. These new calls also indicate the underlying method (GET / POST) used for the API call. Also, it's better to have POST method calls for all non-listing, state changing APIs from UI, so keeping these changes as it is. Any merge conflicts / issues, we(or the authors)'ll resolve them.

github-actions · 2025-07-03T07:56:59Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

…changing APIs Co-authored-by: Kevin Li <[email protected]>

Co-authored-by: Kevin Li <[email protected]>

…rviceTab

sureshanaparti · 2025-07-04T08:34:48Z

@blueorangutan package

blueorangutan · 2025-07-04T08:36:03Z

@sureshanaparti a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

kiranchavala

LGTM

Enabled the global setting "enforce.post.requests.and.timestamps” to true
Execute some API's like create volume /delete network API
Monitor the network traffic via wireshark and we can see the POST request is enforced

weizhouapache

code lgtm

blueorangutan · 2025-07-04T10:11:36Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14026

sureshanaparti · 2025-07-04T10:51:47Z

@blueorangutan test

blueorangutan · 2025-07-04T10:54:08Z

@sureshanaparti a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-07-05T03:10:48Z

[SF] Trillian test result (tid-13677)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 55487 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10899-t13677-kvm-ol8.zip
Smoke tests completed. 141 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

sureshanaparti changed the base branch from main to 4.20 May 21, 2025 12:24

boring-cyborg bot added component:api component:UI labels May 21, 2025

sureshanaparti added this to the 4.20.2 milestone May 22, 2025

sureshanaparti force-pushed the support-apiserver-to-enforce-post-requests-with-timestamps branch from c1a31a9 to d5bde7c Compare May 23, 2025 08:34

sureshanaparti changed the base branch from 4.20 to main May 23, 2025 08:34

sureshanaparti modified the milestones: 4.20.2, 4.21.0 May 23, 2025

sureshanaparti changed the title ~~[WIP] Support ApiServer to enforce POST requests with timestamps for state changing APIs~~ Support ApiServer to enforce POST requests for state changing APIs and requests with timestamps May 23, 2025

sureshanaparti requested a review from Copilot June 26, 2025 12:30

sureshanaparti marked this pull request as ready for review June 26, 2025 12:31

Copilot AI reviewed Jun 26, 2025

View reviewed changes

shwstppr reviewed Jul 1, 2025

View reviewed changes

sureshanaparti requested a review from shwstppr July 3, 2025 05:52

github-actions bot added the status:has-conflicts label Jul 3, 2025

sureshanaparti and others added 10 commits July 4, 2025 14:03

Support ApiServer to enforce POST requests with timestamps for state …

57919be

…changing APIs Co-authored-by: Kevin Li <[email protected]>

UI changes to use POST requests for state changing APIs

d233aa6

Co-authored-by: Kevin Li <[email protected]>

code improvements

8543de0

UI fixes and changes to use POST requests for state changing APIs

559891e

add verifyoauthcodeandgetuser to get cmd list

cc55e20

UI changes for storage access group apis

1d10bd0

fixes

7ffb32f

update logging for post requests

7276762

UI changes for new api calls

1f3c330

UI changes for new api calls in CreateKubernetesCluster, KubernetesSe…

a1f2604

…rviceTab

sureshanaparti force-pushed the support-apiserver-to-enforce-post-requests-with-timestamps branch from 75107b7 to a1f2604 Compare July 4, 2025 08:34

github-actions bot removed the status:has-conflicts label Jul 4, 2025

kiranchavala approved these changes Jul 4, 2025

View reviewed changes

weizhouapache approved these changes Jul 4, 2025

View reviewed changes

DaanHoogland merged commit 749ddb9 into apache:main Jul 5, 2025
25 of 26 checks passed

github-project-automation bot moved this from In Progress to Done in Apache CloudStack 4.21.0 Jul 5, 2025

DaanHoogland deleted the support-apiserver-to-enforce-post-requests-with-timestamps branch July 5, 2025 13:25

Support ApiServer to enforce POST requests for state changing APIs and requests with timestamps #10899

Support ApiServer to enforce POST requests for state changing APIs and requests with timestamps #10899

Uh oh!

Conversation

sureshanaparti commented May 21, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

sureshanaparti commented May 21, 2025

Uh oh!

blueorangutan commented May 21, 2025

Uh oh!

blueorangutan commented May 21, 2025

Uh oh!

sureshanaparti commented May 21, 2025

Uh oh!

blueorangutan commented May 21, 2025

Uh oh!

blueorangutan commented May 22, 2025

Uh oh!

sureshanaparti commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

codecov bot commented May 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

sureshanaparti commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

sureshanaparti commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

blueorangutan commented May 23, 2025

Uh oh!

borisstoyanov commented May 27, 2025

Uh oh!

blueorangutan commented May 27, 2025

Uh oh!

blueorangutan commented May 28, 2025

Uh oh!

sureshanaparti commented Jun 2, 2025

Uh oh!

blueorangutan commented Jun 2, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

shwstppr left a comment

Choose a reason for hiding this comment

Uh oh!

shwstppr Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

sureshanaparti Jul 1, 2025

Choose a reason for hiding this comment

Uh oh!

sureshanaparti Jul 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Jul 3, 2025

Uh oh!

sureshanaparti commented May 21, 2025 •

edited

Loading

codecov bot commented May 23, 2025 •

edited

Loading

shwstppr Jul 1, 2025 •

edited

Loading

sureshanaparti Jul 1, 2025 •

edited

Loading