Custom routes for System VMs

[mahdiadnan]

Hi,

I've noticed that there's no way "or a clean way" to add custom routes to System VMs.
System VMs, when trying to reach other Infrastructure services like Secondary Storage or a reverse proxy for CPVM, it uses the public network and I think it is not practicial to use a public network to connect to vital infrastructure service like Secondary Storage or when proxied behind a reverse proxy. At least we should be able to add a custom route to the System VM to use the Management network.

[daviftorres]

Hey @mahdiadnan ,

I raised similar issues before:

• Enhance Security for SysVMs Behind Reverse Proxy #11020
• Nginx or Apache as a reverse proxy in front of CloudStack (including VNC console support) #11562 (reply in thread)

There is a way to customize the SSVM when it loads a compressed archive at startup. This is what I’d put in the “non-clean way” category you mentioned. See steps:

cd /usr/share/cloudstack-common/vms/
cp cloud-scripts.tgz cloud-scripts.tgz_bkp
mkdir tmp
cd tmp/
tar xzvf ../cloud-scripts.tgz

  #   ADD YOUR CHANGES HERE

rm ../cloud-scripts.tgz
tar -czvf ../cloud-scripts.tgz *
cd ..
rm -rf tmp

The downside. It requires manual edits to the .tgz, which get overwritten whenever cloudstack-agent is updated.

In our setup, we still use this method, because we want to control access to /copy* on reverse-proxy rules. But you can create the route you described with the same technique.