public inbox for git-commits@fedoraproject.org
help / color / mirror / Atom feed
* [rpms/fence-agents] eln: - fence_vmware_rest: add token-based authentication
@ 2026-09-04 13:57 Arslan Ahmad
0 siblings, 0 replies; 3+ messages in thread
From: Arslan Ahmad @ 2026-09-04 13:57 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/fence-agents
Branch : eln
Commit : 6f5c7c569e08ecd66b90c16d55a264962bf9ae8a
Author : Arslan Ahmad <arahmad@redhat.com>
Date : 2026-09-04T09:51:57-04:00
Stats : +293/-177 in 4 file(s)
URL : https://src.fedoraproject.org/rpms/fence-agents/c/6f5c7c569e08ecd66b90c16d55a264962bf9ae8a?branch=eln
Log:
- fence_vmware_rest: add token-based authentication
Resolves: RHEL-191488
---
diff --git a/RHEL-191488-1-fence_vmware_rest-add-token-based-authentication.patch b/RHEL-191488-1-fence_vmware_rest-add-token-based-authentication.patch
new file mode 100644
index 0000000..824e5d8
--- /dev/null
+++ b/RHEL-191488-1-fence_vmware_rest-add-token-based-authentication.patch
@@ -0,0 +1,171 @@
+From 1a943d5c131ae65b01bdd44a816f3903cb878b87 Mon Sep 17 00:00:00 2001
+From: Arslan Ahmad <arahmad@redhat.com>
+Date: Wed, 8 Jul 2026 21:51:53 +0530
+Subject: [PATCH] fence_vmware_rest: add token-based authentication support
+
+This introduces `--token` and `--token-script` parameters to allow secure,
+passwordless authentication with the vCenter REST API. This avoids the
+need to store static passwords or short-lived session IDs in the cluster
+configuration.
+
+ - Adds dynamic bypass of core credential validation when a token is used.
+ - Adds a `fail_usage` check if neither authentication method is provided.
+ - Streamlines `connect()` to cleanly handle both token and credential
+workflows.
+
+Signed-off-by: Arslan Ahmad <arahmad@redhat.com>
+---
+ agents/vmware_rest/fence_vmware_rest.py | 49 ++++++++++++++++++-----
+ tests/data/metadata/fence_vmware_rest.xml | 14 ++++++-
+ 2 files changed, 51 insertions(+), 12 deletions(-)
+
+diff --git a/agents/vmware_rest/fence_vmware_rest.py b/agents/vmware_rest/fence_vmware_rest.py
+index 9dc9a12f4..fb9d42861 100644
+--- a/agents/vmware_rest/fence_vmware_rest.py
++++ b/agents/vmware_rest/fence_vmware_rest.py
+@@ -6,7 +6,7 @@
+ import atexit
+ sys.path.append("@FENCEAGENTSLIBDIR@")
+ from fencing import *
+-from fencing import fail, run_delay, EC_LOGIN_DENIED, EC_STATUS
++from fencing import fail, fail_usage, run_command, run_delay, EC_LOGIN_DENIED, EC_STATUS
+
+ if sys.version_info[0] > 2: import urllib.parse as urllib
+ else: import urllib
+@@ -69,6 +69,8 @@ def get_list(conn, options):
+ return outlets
+
+ def connect(opt):
++ if "--token" not in opt and ("--username" not in opt or "--password" not in opt):
++ fail_usage("Failed: You must provide either a token, a token-script, or a username/password.")
+ conn = pycurl.Curl()
+
+ ## setup correct URL
+@@ -88,9 +90,6 @@ def connect(opt):
+ "Accept: application/json",
+ ])
+
+- conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_BASIC)
+- conn.setopt(pycurl.USERPWD, opt["--username"] + ":" + opt["--password"])
+-
+ conn.setopt(pycurl.TIMEOUT, int(opt["--shell-timeout"]))
+
+ if "--ssl-secure" in opt:
+@@ -100,16 +99,22 @@ def connect(opt):
+ conn.setopt(pycurl.SSL_VERIFYPEER, 0)
+ conn.setopt(pycurl.SSL_VERIFYHOST, 0)
+
+- try:
+- result = send_command(conn, "com/vmware/cis/session", "POST")
+- except Exception as e:
+- logging.debug("Failed: {}".format(e))
+- fail(EC_LOGIN_DENIED)
++ if "--token" not in opt:
++ conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_BASIC)
++ conn.setopt(pycurl.USERPWD, opt["--username"] + ":" + opt["--password"])
++
++ try:
++ result = send_command(conn, "com/vmware/cis/session", "POST")
++ except Exception as e:
++ logging.debug("Failed: {}".format(e))
++ fail(EC_LOGIN_DENIED)
++
++ conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_NONE)
+
+ # set session id for later requests
+ conn.setopt(pycurl.HTTPHEADER, [
+ "Accept: application/json",
+- "vmware-api-session-id: {}".format(result["value"]),
++ "vmware-api-session-id: {}".format(opt["--token"] if "--token" in opt else result["value"]),
+ ])
+
+ return conn
+@@ -182,6 +187,20 @@ def define_new_opts():
+ "shortdesc" : "Filter to only return relevant VMs. It can be used to avoid "
+ "the agent failing when more than 1000 VMs should be returned.",
+ "order" : 2}
++ all_opt["token"] = {
++ "getopt" : ":",
++ "longopt" : "token",
++ "help" : "--token=[token] API Token",
++ "required" : "0",
++ "shortdesc" : "API Token",
++ "order" : 2}
++ all_opt["token_script"] = {
++ "getopt" : ":",
++ "longopt" : "token-script",
++ "help" : "--token-script=[script] Script to retrieve a token",
++ "required" : "0",
++ "shortdesc" : "Script to retrieve a token",
++ "order" : 2}
+
+
+ def main():
+@@ -190,11 +209,15 @@ def main():
+ "api_path",
+ "login",
+ "passwd",
++ "no_login",
++ "no_password",
+ "ssl",
+ "notls",
+ "web",
+ "port",
+ "filter",
++ "token",
++ "token_script",
+ ]
+
+ atexit.register(atexit_handler)
+@@ -204,6 +227,12 @@ def main():
+ all_opt["power_wait"]["default"] = "1"
+
+ options = check_input(device_opt, process_input(device_opt))
++ if "--token-script" in options:
++ try:
++ options["--token"] = run_command(options, options["--token-script"])[1].strip()
++ except Exception as e:
++ logging.error("Failed to execute token script: {}".format(e))
++ sys.exit(EC_LOGIN_DENIED)
+
+ docs = {}
+ docs["shortdesc"] = "Fence agent for VMware REST API"
+diff --git a/tests/data/metadata/fence_vmware_rest.xml b/tests/data/metadata/fence_vmware_rest.xml
+index 672769d99..72fc22533 100644
+--- a/tests/data/metadata/fence_vmware_rest.xml
++++ b/tests/data/metadata/fence_vmware_rest.xml
+@@ -25,7 +25,7 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
+ <content type="integer" default="80" />
+ <shortdesc lang="en">TCP/UDP port to use for connection with device</shortdesc>
+ </parameter>
+- <parameter name="login" unique="0" required="1" deprecated="1">
++ <parameter name="login" unique="0" required="0" deprecated="1">
+ <getopt mixed="-l, --username=[name]" />
+ <content type="string" />
+ <shortdesc lang="en">Login name</shortdesc>
+@@ -80,7 +80,7 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
+ <content type="boolean" />
+ <shortdesc lang="en">Use SSL connection with verifying certificate</shortdesc>
+ </parameter>
+- <parameter name="username" unique="0" required="1" obsoletes="login">
++ <parameter name="username" unique="0" required="0" obsoletes="login">
+ <getopt mixed="-l, --username=[name]" />
+ <content type="string" />
+ <shortdesc lang="en">Login name</shortdesc>
+@@ -94,6 +94,16 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
+ <content type="string" />
+ <shortdesc lang="en">Filter to only return relevant VMs. It can be used to avoid the agent failing when more than 1000 VMs should be returned.</shortdesc>
+ </parameter>
++ <parameter name="token" unique="0" required="0">
++ <getopt mixed="--token=[token]" />
++ <content type="string" />
++ <shortdesc lang="en">API Token</shortdesc>
++ </parameter>
++ <parameter name="token_script" unique="0" required="0">
++ <getopt mixed="--token-script=[script]" />
++ <content type="string" />
++ <shortdesc lang="en">Script to retrieve a token</shortdesc>
++ </parameter>
+ <parameter name="quiet" unique="0" required="0">
+ <getopt mixed="-q, --quiet" />
+ <content type="boolean" />
diff --git a/RHEL-191488-2-fence_vmware_rest-remove-static-token-option.patch b/RHEL-191488-2-fence_vmware_rest-remove-static-token-option.patch
new file mode 100644
index 0000000..e6a2afc
--- /dev/null
+++ b/RHEL-191488-2-fence_vmware_rest-remove-static-token-option.patch
@@ -0,0 +1,114 @@
+From 9d63480532597b4a0508d049a8d4f933c468552e Mon Sep 17 00:00:00 2001
+From: Arslan Ahmad <arahmad@redhat.com>
+Date: Wed, 29 Jul 2026 19:18:10 +0530
+Subject: [PATCH] fence_vmware_rest: remove static --token option
+
+A static token provided via `--token` gets invalidated
+immediately after the agent's first execution as it destroys
+its session (HTTP DELETE) with vCenter upon disconnect.
+
+Passwordless authentication must use `--token-script` to
+fetch a fresh session token dynamically on every invocation.
+
+Signed-off-by: Arslan Ahmad <arahmad@redhat.com>
+---
+ agents/vmware_rest/fence_vmware_rest.py | 25 ++++++++---------------
+ tests/data/metadata/fence_vmware_rest.xml | 5 -----
+ 2 files changed, 9 insertions(+), 21 deletions(-)
+
+diff --git a/agents/vmware_rest/fence_vmware_rest.py b/agents/vmware_rest/fence_vmware_rest.py
+index fb9d42861..7e790c306 100644
+--- a/agents/vmware_rest/fence_vmware_rest.py
++++ b/agents/vmware_rest/fence_vmware_rest.py
+@@ -68,9 +68,9 @@ def get_list(conn, options):
+
+ return outlets
+
+-def connect(opt):
+- if "--token" not in opt and ("--username" not in opt or "--password" not in opt):
+- fail_usage("Failed: You must provide either a token, a token-script, or a username/password.")
++def connect(opt, token=None):
++ if token is None and ("--username" not in opt or "--password" not in opt):
++ fail_usage("Failed: You must provide either a token-script or a username/password.")
+ conn = pycurl.Curl()
+
+ ## setup correct URL
+@@ -99,7 +99,7 @@ def connect(opt):
+ conn.setopt(pycurl.SSL_VERIFYPEER, 0)
+ conn.setopt(pycurl.SSL_VERIFYHOST, 0)
+
+- if "--token" not in opt:
++ if token is None:
+ conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_BASIC)
+ conn.setopt(pycurl.USERPWD, opt["--username"] + ":" + opt["--password"])
+
+@@ -114,7 +114,7 @@ def connect(opt):
+ # set session id for later requests
+ conn.setopt(pycurl.HTTPHEADER, [
+ "Accept: application/json",
+- "vmware-api-session-id: {}".format(opt["--token"] if "--token" in opt else result["value"]),
++ "vmware-api-session-id: {}".format(token if token is not None else result["value"]),
+ ])
+
+ return conn
+@@ -187,13 +187,6 @@ def define_new_opts():
+ "shortdesc" : "Filter to only return relevant VMs. It can be used to avoid "
+ "the agent failing when more than 1000 VMs should be returned.",
+ "order" : 2}
+- all_opt["token"] = {
+- "getopt" : ":",
+- "longopt" : "token",
+- "help" : "--token=[token] API Token",
+- "required" : "0",
+- "shortdesc" : "API Token",
+- "order" : 2}
+ all_opt["token_script"] = {
+ "getopt" : ":",
+ "longopt" : "token-script",
+@@ -216,7 +209,6 @@ def main():
+ "web",
+ "port",
+ "filter",
+- "token",
+ "token_script",
+ ]
+
+@@ -226,10 +218,11 @@ def main():
+ all_opt["shell_timeout"]["default"] = "5"
+ all_opt["power_wait"]["default"] = "1"
+
+- options = check_input(device_opt, process_input(device_opt))
++ options = check_input(device_opt, process_input(device_opt))
++ token = None
+ if "--token-script" in options:
+ try:
+- options["--token"] = run_command(options, options["--token-script"])[1].strip()
++ token = run_command(options, options["--token-script"])[1].strip()
+ except Exception as e:
+ logging.error("Failed to execute token script: {}".format(e))
+ sys.exit(EC_LOGIN_DENIED)
+@@ -250,7 +243,7 @@ def main():
+ ####
+ run_delay(options)
+
+- conn = connect(options)
++ conn = connect(options, token)
+ atexit.register(disconnect, conn)
+
+ result = fence_action(conn, options, set_power_status, get_power_status, get_list)
+diff --git a/tests/data/metadata/fence_vmware_rest.xml b/tests/data/metadata/fence_vmware_rest.xml
+index 72fc22533..66ba7e008 100644
+--- a/tests/data/metadata/fence_vmware_rest.xml
++++ b/tests/data/metadata/fence_vmware_rest.xml
+@@ -94,11 +94,6 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
+ <content type="string" />
+ <shortdesc lang="en">Filter to only return relevant VMs. It can be used to avoid the agent failing when more than 1000 VMs should be returned.</shortdesc>
+ </parameter>
+- <parameter name="token" unique="0" required="0">
+- <getopt mixed="--token=[token]" />
+- <content type="string" />
+- <shortdesc lang="en">API Token</shortdesc>
+- </parameter>
+ <parameter name="token_script" unique="0" required="0">
+ <getopt mixed="--token-script=[script]" />
+ <content type="string" />
diff --git a/RHEL-191488-fence_vmware_rest-add-token-based-authentication.patch b/RHEL-191488-fence_vmware_rest-add-token-based-authentication.patch
deleted file mode 100644
index 824e5d8..0000000
--- a/RHEL-191488-fence_vmware_rest-add-token-based-authentication.patch
+++ /dev/null
@@ -1,171 +0,0 @@
-From 1a943d5c131ae65b01bdd44a816f3903cb878b87 Mon Sep 17 00:00:00 2001
-From: Arslan Ahmad <arahmad@redhat.com>
-Date: Wed, 8 Jul 2026 21:51:53 +0530
-Subject: [PATCH] fence_vmware_rest: add token-based authentication support
-
-This introduces `--token` and `--token-script` parameters to allow secure,
-passwordless authentication with the vCenter REST API. This avoids the
-need to store static passwords or short-lived session IDs in the cluster
-configuration.
-
- - Adds dynamic bypass of core credential validation when a token is used.
- - Adds a `fail_usage` check if neither authentication method is provided.
- - Streamlines `connect()` to cleanly handle both token and credential
-workflows.
-
-Signed-off-by: Arslan Ahmad <arahmad@redhat.com>
----
- agents/vmware_rest/fence_vmware_rest.py | 49 ++++++++++++++++++-----
- tests/data/metadata/fence_vmware_rest.xml | 14 ++++++-
- 2 files changed, 51 insertions(+), 12 deletions(-)
-
-diff --git a/agents/vmware_rest/fence_vmware_rest.py b/agents/vmware_rest/fence_vmware_rest.py
-index 9dc9a12f4..fb9d42861 100644
---- a/agents/vmware_rest/fence_vmware_rest.py
-+++ b/agents/vmware_rest/fence_vmware_rest.py
-@@ -6,7 +6,7 @@
- import atexit
- sys.path.append("@FENCEAGENTSLIBDIR@")
- from fencing import *
--from fencing import fail, run_delay, EC_LOGIN_DENIED, EC_STATUS
-+from fencing import fail, fail_usage, run_command, run_delay, EC_LOGIN_DENIED, EC_STATUS
-
- if sys.version_info[0] > 2: import urllib.parse as urllib
- else: import urllib
-@@ -69,6 +69,8 @@ def get_list(conn, options):
- return outlets
-
- def connect(opt):
-+ if "--token" not in opt and ("--username" not in opt or "--password" not in opt):
-+ fail_usage("Failed: You must provide either a token, a token-script, or a username/password.")
- conn = pycurl.Curl()
-
- ## setup correct URL
-@@ -88,9 +90,6 @@ def connect(opt):
- "Accept: application/json",
- ])
-
-- conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_BASIC)
-- conn.setopt(pycurl.USERPWD, opt["--username"] + ":" + opt["--password"])
--
- conn.setopt(pycurl.TIMEOUT, int(opt["--shell-timeout"]))
-
- if "--ssl-secure" in opt:
-@@ -100,16 +99,22 @@ def connect(opt):
- conn.setopt(pycurl.SSL_VERIFYPEER, 0)
- conn.setopt(pycurl.SSL_VERIFYHOST, 0)
-
-- try:
-- result = send_command(conn, "com/vmware/cis/session", "POST")
-- except Exception as e:
-- logging.debug("Failed: {}".format(e))
-- fail(EC_LOGIN_DENIED)
-+ if "--token" not in opt:
-+ conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_BASIC)
-+ conn.setopt(pycurl.USERPWD, opt["--username"] + ":" + opt["--password"])
-+
-+ try:
-+ result = send_command(conn, "com/vmware/cis/session", "POST")
-+ except Exception as e:
-+ logging.debug("Failed: {}".format(e))
-+ fail(EC_LOGIN_DENIED)
-+
-+ conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_NONE)
-
- # set session id for later requests
- conn.setopt(pycurl.HTTPHEADER, [
- "Accept: application/json",
-- "vmware-api-session-id: {}".format(result["value"]),
-+ "vmware-api-session-id: {}".format(opt["--token"] if "--token" in opt else result["value"]),
- ])
-
- return conn
-@@ -182,6 +187,20 @@ def define_new_opts():
- "shortdesc" : "Filter to only return relevant VMs. It can be used to avoid "
- "the agent failing when more than 1000 VMs should be returned.",
- "order" : 2}
-+ all_opt["token"] = {
-+ "getopt" : ":",
-+ "longopt" : "token",
-+ "help" : "--token=[token] API Token",
-+ "required" : "0",
-+ "shortdesc" : "API Token",
-+ "order" : 2}
-+ all_opt["token_script"] = {
-+ "getopt" : ":",
-+ "longopt" : "token-script",
-+ "help" : "--token-script=[script] Script to retrieve a token",
-+ "required" : "0",
-+ "shortdesc" : "Script to retrieve a token",
-+ "order" : 2}
-
-
- def main():
-@@ -190,11 +209,15 @@ def main():
- "api_path",
- "login",
- "passwd",
-+ "no_login",
-+ "no_password",
- "ssl",
- "notls",
- "web",
- "port",
- "filter",
-+ "token",
-+ "token_script",
- ]
-
- atexit.register(atexit_handler)
-@@ -204,6 +227,12 @@ def main():
- all_opt["power_wait"]["default"] = "1"
-
- options = check_input(device_opt, process_input(device_opt))
-+ if "--token-script" in options:
-+ try:
-+ options["--token"] = run_command(options, options["--token-script"])[1].strip()
-+ except Exception as e:
-+ logging.error("Failed to execute token script: {}".format(e))
-+ sys.exit(EC_LOGIN_DENIED)
-
- docs = {}
- docs["shortdesc"] = "Fence agent for VMware REST API"
-diff --git a/tests/data/metadata/fence_vmware_rest.xml b/tests/data/metadata/fence_vmware_rest.xml
-index 672769d99..72fc22533 100644
---- a/tests/data/metadata/fence_vmware_rest.xml
-+++ b/tests/data/metadata/fence_vmware_rest.xml
-@@ -25,7 +25,7 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
- <content type="integer" default="80" />
- <shortdesc lang="en">TCP/UDP port to use for connection with device</shortdesc>
- </parameter>
-- <parameter name="login" unique="0" required="1" deprecated="1">
-+ <parameter name="login" unique="0" required="0" deprecated="1">
- <getopt mixed="-l, --username=[name]" />
- <content type="string" />
- <shortdesc lang="en">Login name</shortdesc>
-@@ -80,7 +80,7 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
- <content type="boolean" />
- <shortdesc lang="en">Use SSL connection with verifying certificate</shortdesc>
- </parameter>
-- <parameter name="username" unique="0" required="1" obsoletes="login">
-+ <parameter name="username" unique="0" required="0" obsoletes="login">
- <getopt mixed="-l, --username=[name]" />
- <content type="string" />
- <shortdesc lang="en">Login name</shortdesc>
-@@ -94,6 +94,16 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
- <content type="string" />
- <shortdesc lang="en">Filter to only return relevant VMs. It can be used to avoid the agent failing when more than 1000 VMs should be returned.</shortdesc>
- </parameter>
-+ <parameter name="token" unique="0" required="0">
-+ <getopt mixed="--token=[token]" />
-+ <content type="string" />
-+ <shortdesc lang="en">API Token</shortdesc>
-+ </parameter>
-+ <parameter name="token_script" unique="0" required="0">
-+ <getopt mixed="--token-script=[script]" />
-+ <content type="string" />
-+ <shortdesc lang="en">Script to retrieve a token</shortdesc>
-+ </parameter>
- <parameter name="quiet" unique="0" required="0">
- <getopt mixed="-q, --quiet" />
- <content type="boolean" />
diff --git a/fence-agents.spec b/fence-agents.spec
index d5e28f0..355a367 100644
--- a/fence-agents.spec
+++ b/fence-agents.spec
@@ -13,7 +13,7 @@
Name: fence-agents
Summary: Set of unified programs capable of host isolation ("fencing")
Version: 4.16.0
-Release: 31%{?alphatag:.%{alphatag}}%{?dist}
+Release: 32%{?alphatag:.%{alphatag}}%{?dist}
License: GPL-2.0-or-later AND LGPL-2.0-or-later
URL: https://github.com/ClusterLabs/fence-agents
Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz
@@ -127,7 +127,8 @@ Patch21: RHEL-170614-fence_virtd-fix-discard-const-error-with-GCC-16.patch
Patch22: RHEL-81658-fence_kubevirt-report-Succeeded-and-Failed-as-OFF.patch
Patch23: RHEL-140160-fence_ibm_vpc-set-proxy-when-token-is-expired-as-well.patch
Patch24: RHEL-155007-fence_openstack-fix-list-action-to-avoid-timeout-with-large-number-of-VMs.patch
-Patch25: RHEL-191488-fence_vmware_rest-add-token-based-authentication.patch
+Patch25: RHEL-191488-1-fence_vmware_rest-add-token-based-authentication.patch
+Patch26: RHEL-191488-2-fence_vmware_rest-remove-static-token-option.patch
%global supportedagents amt_ws apc apc_snmp bladecenter brocade cisco_mds cisco_ucs drac5 eaton_snmp emerson eps hpblade ibmblade ibm_powervs ibm_vpc ifmib ilo ilo_moonshot ilo_mp ilo_ssh intelmodular ipdu ipmilan kdump kubevirt lpar mpath nutanix_ahv redfish rhevm rsa rsb sbd scsi vmware_rest vmware_soap wti
%ifarch x86_64
@@ -265,6 +266,7 @@ BuildRequires: %{systemd_units}
%patch -p1 -P 23
%patch -p1 -P 24
%patch -p1 -P 25
+%patch -p1 -P 26
# prevent compilation of something that won't get used anyway
sed -i.orig 's|FENCE_ZVM=1|FENCE_ZVM=0|' configure.ac
@@ -1244,14 +1246,14 @@ are located on corosync cluster nodes.
%endif
%changelog
+* Thu Jul 30 2026 Arslan Ahmad <arahmad@redhat.com> - 4.16.0-32
+- fence_vmware_rest: add token-based authentication
+ Resolves: RHEL-191488
+
* Tue Jul 14 2026 Oyvind Albrigtsen <oalbrigt@redhat.com> - 4.16.0-31
- bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939
Resolves: RHEL-193809
-* Thu Jul 09 2026 Arslan Ahmad <arahmad@redhat.com> - 4.16.0-30
-- fence_vmware_rest: add token-based authentication
- Resolves: RHEL-191488
-
* Wed Jun 17 2026 Arslan Ahmad <arahmad@redhat.com> - 4.16.0-29
- fence_openstack: fix list-action to avoid timeout when
there are 100+ VMs on the hypervisor
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [rpms/fence-agents] eln: - fence_vmware_rest: add token-based authentication
@ 2026-09-04 13:57 Arslan Ahmad
0 siblings, 0 replies; 3+ messages in thread
From: Arslan Ahmad @ 2026-09-04 13:57 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/fence-agents
Branch : eln
Commit : 83e6b32d063b25a355e74c75874a6a4c686c0e72
Author : Arslan Ahmad <arahmad@redhat.com>
Date : 2026-09-04T09:51:59-04:00
Stats : +8/-10 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/fence-agents/c/83e6b32d063b25a355e74c75874a6a4c686c0e72?branch=eln
Log:
- fence_vmware_rest: add token-based authentication
Resolves: RHEL-191488
---
diff --git a/RHEL-191488-2-fence_vmware_rest-remove-static-token-option.patch b/RHEL-191488-2-fence_vmware_rest-remove-static-token-option.patch
index e6a2afc..bd6f63e 100644
--- a/RHEL-191488-2-fence_vmware_rest-remove-static-token-option.patch
+++ b/RHEL-191488-2-fence_vmware_rest-remove-static-token-option.patch
@@ -1,4 +1,4 @@
-From 9d63480532597b4a0508d049a8d4f933c468552e Mon Sep 17 00:00:00 2001
+From 52fecd207e28386283c8389c2dd43bda59c8becf Mon Sep 17 00:00:00 2001
From: Arslan Ahmad <arahmad@redhat.com>
Date: Wed, 29 Jul 2026 19:18:10 +0530
Subject: [PATCH] fence_vmware_rest: remove static --token option
@@ -12,12 +12,12 @@ fetch a fresh session token dynamically on every invocation.
Signed-off-by: Arslan Ahmad <arahmad@redhat.com>
---
- agents/vmware_rest/fence_vmware_rest.py | 25 ++++++++---------------
+ agents/vmware_rest/fence_vmware_rest.py | 23 ++++++++---------------
tests/data/metadata/fence_vmware_rest.xml | 5 -----
- 2 files changed, 9 insertions(+), 21 deletions(-)
+ 2 files changed, 8 insertions(+), 20 deletions(-)
diff --git a/agents/vmware_rest/fence_vmware_rest.py b/agents/vmware_rest/fence_vmware_rest.py
-index fb9d42861..7e790c306 100644
+index fb9d42861..c14e5559d 100644
--- a/agents/vmware_rest/fence_vmware_rest.py
+++ b/agents/vmware_rest/fence_vmware_rest.py
@@ -68,9 +68,9 @@ def get_list(conn, options):
@@ -73,12 +73,10 @@ index fb9d42861..7e790c306 100644
"token_script",
]
-@@ -226,10 +218,11 @@ def main():
- all_opt["shell_timeout"]["default"] = "5"
+@@ -227,9 +219,10 @@ def main():
all_opt["power_wait"]["default"] = "1"
-- options = check_input(device_opt, process_input(device_opt))
-+ options = check_input(device_opt, process_input(device_opt))
+ options = check_input(device_opt, process_input(device_opt))
+ token = None
if "--token-script" in options:
try:
diff --git a/fence-agents.spec b/fence-agents.spec
index 355a367..d67e1a9 100644
--- a/fence-agents.spec
+++ b/fence-agents.spec
@@ -13,7 +13,7 @@
Name: fence-agents
Summary: Set of unified programs capable of host isolation ("fencing")
Version: 4.16.0
-Release: 32%{?alphatag:.%{alphatag}}%{?dist}
+Release: 33%{?alphatag:.%{alphatag}}%{?dist}
License: GPL-2.0-or-later AND LGPL-2.0-or-later
URL: https://github.com/ClusterLabs/fence-agents
Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz
@@ -1246,7 +1246,7 @@ are located on corosync cluster nodes.
%endif
%changelog
-* Thu Jul 30 2026 Arslan Ahmad <arahmad@redhat.com> - 4.16.0-32
+* Fri Jul 31 2026 Arslan Ahmad <arahmad@redhat.com> - 4.16.0-33
- fence_vmware_rest: add token-based authentication
Resolves: RHEL-191488
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [rpms/fence-agents] eln: - fence_vmware_rest: add token-based authentication
@ 2026-07-15 20:26 Arslan Ahmad
0 siblings, 0 replies; 3+ messages in thread
From: Arslan Ahmad @ 2026-07-15 20:26 UTC (permalink / raw)
To: git-commits
A new commit has been pushed.
Repo : rpms/fence-agents
Branch : eln
Commit : 5b821a8a247626b122d14f3cc990bd4a7798f538
Author : Arslan Ahmad <arahmad@redhat.com>
Date : 2026-07-15T16:17:12-04:00
Stats : +178/-1 in 2 file(s)
URL : https://src.fedoraproject.org/rpms/fence-agents/c/5b821a8a247626b122d14f3cc990bd4a7798f538?branch=eln
Log:
- fence_vmware_rest: add token-based authentication
Resolves: RHEL-191488
---
diff --git a/RHEL-191488-fence_vmware_rest-add-token-based-authentication.patch b/RHEL-191488-fence_vmware_rest-add-token-based-authentication.patch
new file mode 100644
index 0000000..824e5d8
--- /dev/null
+++ b/RHEL-191488-fence_vmware_rest-add-token-based-authentication.patch
@@ -0,0 +1,171 @@
+From 1a943d5c131ae65b01bdd44a816f3903cb878b87 Mon Sep 17 00:00:00 2001
+From: Arslan Ahmad <arahmad@redhat.com>
+Date: Wed, 8 Jul 2026 21:51:53 +0530
+Subject: [PATCH] fence_vmware_rest: add token-based authentication support
+
+This introduces `--token` and `--token-script` parameters to allow secure,
+passwordless authentication with the vCenter REST API. This avoids the
+need to store static passwords or short-lived session IDs in the cluster
+configuration.
+
+ - Adds dynamic bypass of core credential validation when a token is used.
+ - Adds a `fail_usage` check if neither authentication method is provided.
+ - Streamlines `connect()` to cleanly handle both token and credential
+workflows.
+
+Signed-off-by: Arslan Ahmad <arahmad@redhat.com>
+---
+ agents/vmware_rest/fence_vmware_rest.py | 49 ++++++++++++++++++-----
+ tests/data/metadata/fence_vmware_rest.xml | 14 ++++++-
+ 2 files changed, 51 insertions(+), 12 deletions(-)
+
+diff --git a/agents/vmware_rest/fence_vmware_rest.py b/agents/vmware_rest/fence_vmware_rest.py
+index 9dc9a12f4..fb9d42861 100644
+--- a/agents/vmware_rest/fence_vmware_rest.py
++++ b/agents/vmware_rest/fence_vmware_rest.py
+@@ -6,7 +6,7 @@
+ import atexit
+ sys.path.append("@FENCEAGENTSLIBDIR@")
+ from fencing import *
+-from fencing import fail, run_delay, EC_LOGIN_DENIED, EC_STATUS
++from fencing import fail, fail_usage, run_command, run_delay, EC_LOGIN_DENIED, EC_STATUS
+
+ if sys.version_info[0] > 2: import urllib.parse as urllib
+ else: import urllib
+@@ -69,6 +69,8 @@ def get_list(conn, options):
+ return outlets
+
+ def connect(opt):
++ if "--token" not in opt and ("--username" not in opt or "--password" not in opt):
++ fail_usage("Failed: You must provide either a token, a token-script, or a username/password.")
+ conn = pycurl.Curl()
+
+ ## setup correct URL
+@@ -88,9 +90,6 @@ def connect(opt):
+ "Accept: application/json",
+ ])
+
+- conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_BASIC)
+- conn.setopt(pycurl.USERPWD, opt["--username"] + ":" + opt["--password"])
+-
+ conn.setopt(pycurl.TIMEOUT, int(opt["--shell-timeout"]))
+
+ if "--ssl-secure" in opt:
+@@ -100,16 +99,22 @@ def connect(opt):
+ conn.setopt(pycurl.SSL_VERIFYPEER, 0)
+ conn.setopt(pycurl.SSL_VERIFYHOST, 0)
+
+- try:
+- result = send_command(conn, "com/vmware/cis/session", "POST")
+- except Exception as e:
+- logging.debug("Failed: {}".format(e))
+- fail(EC_LOGIN_DENIED)
++ if "--token" not in opt:
++ conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_BASIC)
++ conn.setopt(pycurl.USERPWD, opt["--username"] + ":" + opt["--password"])
++
++ try:
++ result = send_command(conn, "com/vmware/cis/session", "POST")
++ except Exception as e:
++ logging.debug("Failed: {}".format(e))
++ fail(EC_LOGIN_DENIED)
++
++ conn.setopt(pycurl.HTTPAUTH, pycurl.HTTPAUTH_NONE)
+
+ # set session id for later requests
+ conn.setopt(pycurl.HTTPHEADER, [
+ "Accept: application/json",
+- "vmware-api-session-id: {}".format(result["value"]),
++ "vmware-api-session-id: {}".format(opt["--token"] if "--token" in opt else result["value"]),
+ ])
+
+ return conn
+@@ -182,6 +187,20 @@ def define_new_opts():
+ "shortdesc" : "Filter to only return relevant VMs. It can be used to avoid "
+ "the agent failing when more than 1000 VMs should be returned.",
+ "order" : 2}
++ all_opt["token"] = {
++ "getopt" : ":",
++ "longopt" : "token",
++ "help" : "--token=[token] API Token",
++ "required" : "0",
++ "shortdesc" : "API Token",
++ "order" : 2}
++ all_opt["token_script"] = {
++ "getopt" : ":",
++ "longopt" : "token-script",
++ "help" : "--token-script=[script] Script to retrieve a token",
++ "required" : "0",
++ "shortdesc" : "Script to retrieve a token",
++ "order" : 2}
+
+
+ def main():
+@@ -190,11 +209,15 @@ def main():
+ "api_path",
+ "login",
+ "passwd",
++ "no_login",
++ "no_password",
+ "ssl",
+ "notls",
+ "web",
+ "port",
+ "filter",
++ "token",
++ "token_script",
+ ]
+
+ atexit.register(atexit_handler)
+@@ -204,6 +227,12 @@ def main():
+ all_opt["power_wait"]["default"] = "1"
+
+ options = check_input(device_opt, process_input(device_opt))
++ if "--token-script" in options:
++ try:
++ options["--token"] = run_command(options, options["--token-script"])[1].strip()
++ except Exception as e:
++ logging.error("Failed to execute token script: {}".format(e))
++ sys.exit(EC_LOGIN_DENIED)
+
+ docs = {}
+ docs["shortdesc"] = "Fence agent for VMware REST API"
+diff --git a/tests/data/metadata/fence_vmware_rest.xml b/tests/data/metadata/fence_vmware_rest.xml
+index 672769d99..72fc22533 100644
+--- a/tests/data/metadata/fence_vmware_rest.xml
++++ b/tests/data/metadata/fence_vmware_rest.xml
+@@ -25,7 +25,7 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
+ <content type="integer" default="80" />
+ <shortdesc lang="en">TCP/UDP port to use for connection with device</shortdesc>
+ </parameter>
+- <parameter name="login" unique="0" required="1" deprecated="1">
++ <parameter name="login" unique="0" required="0" deprecated="1">
+ <getopt mixed="-l, --username=[name]" />
+ <content type="string" />
+ <shortdesc lang="en">Login name</shortdesc>
+@@ -80,7 +80,7 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
+ <content type="boolean" />
+ <shortdesc lang="en">Use SSL connection with verifying certificate</shortdesc>
+ </parameter>
+- <parameter name="username" unique="0" required="1" obsoletes="login">
++ <parameter name="username" unique="0" required="0" obsoletes="login">
+ <getopt mixed="-l, --username=[name]" />
+ <content type="string" />
+ <shortdesc lang="en">Login name</shortdesc>
+@@ -94,6 +94,16 @@ NOTE: If there's more than 1000 VMs there is a filter parameter to work around t
+ <content type="string" />
+ <shortdesc lang="en">Filter to only return relevant VMs. It can be used to avoid the agent failing when more than 1000 VMs should be returned.</shortdesc>
+ </parameter>
++ <parameter name="token" unique="0" required="0">
++ <getopt mixed="--token=[token]" />
++ <content type="string" />
++ <shortdesc lang="en">API Token</shortdesc>
++ </parameter>
++ <parameter name="token_script" unique="0" required="0">
++ <getopt mixed="--token-script=[script]" />
++ <content type="string" />
++ <shortdesc lang="en">Script to retrieve a token</shortdesc>
++ </parameter>
+ <parameter name="quiet" unique="0" required="0">
+ <getopt mixed="-q, --quiet" />
+ <content type="boolean" />
diff --git a/fence-agents.spec b/fence-agents.spec
index 13a4f54..7260638 100644
--- a/fence-agents.spec
+++ b/fence-agents.spec
@@ -13,7 +13,7 @@
Name: fence-agents
Summary: Set of unified programs capable of host isolation ("fencing")
Version: 4.16.0
-Release: 29%{?alphatag:.%{alphatag}}%{?dist}
+Release: 30%{?alphatag:.%{alphatag}}%{?dist}
License: GPL-2.0-or-later AND LGPL-2.0-or-later
URL: https://github.com/ClusterLabs/fence-agents
Source0: https://fedorahosted.org/releases/f/e/fence-agents/%{name}-%{version}.tar.gz
@@ -121,6 +121,7 @@ Patch21: RHEL-170614-fence_virtd-fix-discard-const-error-with-GCC-16.patch
Patch22: RHEL-81658-fence_kubevirt-report-Succeeded-and-Failed-as-OFF.patch
Patch23: RHEL-140160-fence_ibm_vpc-set-proxy-when-token-is-expired-as-well.patch
Patch24: RHEL-155007-fence_openstack-fix-list-action-to-avoid-timeout-with-large-number-of-VMs.patch
+Patch25: RHEL-191488-fence_vmware_rest-add-token-based-authentication.patch
%global supportedagents amt_ws apc apc_snmp bladecenter brocade cisco_mds cisco_ucs drac5 eaton_snmp emerson eps hpblade ibmblade ibm_powervs ibm_vpc ifmib ilo ilo_moonshot ilo_mp ilo_ssh intelmodular ipdu ipmilan kdump kubevirt lpar mpath nutanix_ahv redfish rhevm rsa rsb sbd scsi vmware_rest vmware_soap wti
%ifarch x86_64
@@ -255,6 +256,7 @@ BuildRequires: %{systemd_units}
%patch -p1 -P 22
%patch -p1 -P 23
%patch -p1 -P 24
+%patch -p1 -P 25
# prevent compilation of something that won't get used anyway
sed -i.orig 's|FENCE_ZVM=1|FENCE_ZVM=0|' configure.ac
@@ -1227,6 +1229,10 @@ are located on corosync cluster nodes.
%endif
%changelog
+* Thu Jul 09 2026 Arslan Ahmad <arahmad@redhat.com> - 4.16.0-30
+- fence_vmware_rest: add token-based authentication
+ Resolves: RHEL-191488
+
* Wed Jun 17 2026 Arslan Ahmad <arahmad@redhat.com> - 4.16.0-29
- fence_openstack: fix list-action to avoid timeout when
there are 100+ VMs on the hypervisor
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-04 13:57 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-04 13:57 [rpms/fence-agents] eln: - fence_vmware_rest: add token-based authentication Arslan Ahmad
-- strict thread matches above, loose matches on Subject: below --
2026-09-04 13:57 Arslan Ahmad
2026-07-15 20:26 Arslan Ahmad
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox