<fix>[kvm]: define secret on migrate destination

Resolves: ZSV-11729

Change-Id: I616a776e78666179637976616c776162626c6533

Author: zhong.zhou

plugin/kvm/src/main/java/org/zstack/kvm/KVMHost.java

@@ -12,6 +12,8 @@
 import org.zstack.compute.cluster.arch.ClusterResourceConfigInitializer;
 import org.zstack.compute.host.*;
 import org.zstack.compute.vm.*;
+import org.zstack.compute.vm.devices.TpmEncryptedResourceKeyBackend;
+import org.zstack.compute.vm.devices.VmTpmManager;
 import org.zstack.core.asyncbatch.While;
 import org.zstack.core.cloudbus.ResourceDestinationMaker;
 import org.zstack.core.timeout.TimeHelper;
@@ -55,6 +57,9 @@
 import org.zstack.header.exception.CloudRuntimeException;
 import org.zstack.header.host.*;
 import org.zstack.header.host.MigrateVmOnHypervisorMsg.StorageMigrationPolicy;
+import org.zstack.header.keyprovider.EncryptedResourceKeyManager;
+import org.zstack.header.keyprovider.EncryptedResourceKeyManager.GetOrCreateResourceKeyContext;
+import org.zstack.header.keyprovider.EncryptedResourceKeyManager.ResourceKeyResult;
 import org.zstack.header.secret.SecretHostDefineMsg;
 import org.zstack.header.secret.SecretHostDefineReply;
 import org.zstack.header.message.APIMessage;
@@ -68,6 +73,7 @@
 import org.zstack.header.rest.RESTFacade;
 import org.zstack.header.storage.primary.*;
 import org.zstack.header.tag.SystemTagInventory;
+import org.zstack.header.tpm.entity.TpmVO;
 import org.zstack.header.vm.*;
 import org.zstack.header.vm.devices.DeviceAddress;
 import org.zstack.header.volume.*;
@@ -164,6 +170,10 @@ public class KVMHost extends HostBase implements Host {
     private AccountManager accountMgr;
     @Autowired
     private ResourceDestinationMaker destMaker;
+    @Autowired
+    private TpmEncryptedResourceKeyBackend tpmKeyBackend;
+    @Autowired
+    private EncryptedResourceKeyManager resourceKeyManager;
 
     private KVMHostContext context;
 
@@ -3162,6 +3172,89 @@ public void fail(ErrorCode errorCode) {
                     }
                 });
 
+                flow(new Flow() {
+                    String __name__ = "ensure-secret-on-dst-before-migrate";
+                    String ensuredTpmUuid;
+
+                    @Override
+                    public void run(FlowTrigger trigger, Map data) {
+                        String tpmUuid = VmTpmManager.findTpmUuidForVmOrNull(vmUuid);
+                        if (StringUtils.isBlank(tpmUuid)) {
+                            trigger.next();
+                            return;
+                        }
+                        ensuredTpmUuid = tpmUuid;
+
+                        String providerUuid = tpmKeyBackend.findKeyProviderUuidByTpm(tpmUuid);
+                        String providerName = tpmKeyBackend.findKeyProviderNameByTpm(tpmUuid);
+                        if (StringUtils.isBlank(providerUuid) && StringUtils.isBlank(providerName)) {
+                            trigger.fail(operr("missing TPM resource key binding for tpm[uuid:%s] before migrate", tpmUuid));
+                            return;
+                        }
+
+                        GetOrCreateResourceKeyContext keyCtx = new GetOrCreateResourceKeyContext();
+                        keyCtx.setResourceUuid(tpmUuid);
+                        keyCtx.setResourceType(TpmVO.class.getSimpleName());
+                        keyCtx.setKeyProviderUuid(providerUuid);
+                        keyCtx.setKeyProviderName(providerName);
+                        keyCtx.setPurpose("vtpm");
+                        resourceKeyManager.getOrCreateKey(keyCtx, new ReturnValueCompletion<ResourceKeyResult>(trigger) {
+                            @Override
+                            public void success(ResourceKeyResult result) {
+                                String effectiveProviderName = result.getKeyProviderName();
+                                if (StringUtils.isBlank(effectiveProviderName)) {
+                                    effectiveProviderName = providerName;
+                                }
+                                if (StringUtils.isBlank(effectiveProviderName)) {
+                                    trigger.fail(operr("missing effective key provider name for tpm[uuid:%s] before migrate", tpmUuid));
+                                    return;
+                                }
+
+                                SecretHostDefineMsg innerMsg = new SecretHostDefineMsg();
+                                innerMsg.setHostUuid(dstHostUuid);
+                                innerMsg.setVmUuid(vmUuid);
+                                innerMsg.setDekBase64(result.getDekBase64());
+                                innerMsg.setPurpose("vtpm");
+                                innerMsg.setProviderName(effectiveProviderName);
+                                innerMsg.setDescription(String.format("Define secret for VM %s before live migration", vmUuid));
+                                bus.makeTargetServiceIdByResourceUuid(innerMsg, HostConstant.SERVICE_ID, innerMsg.getHostUuid());
+                                bus.send(innerMsg, new CloudBusCallBack(trigger) {
+                                    @Override
+                                    public void run(MessageReply reply) {
+                                        if (reply.isSuccess()) {
+                                            trigger.next();
+                                        } else {
+                                            trigger.fail(reply.getError());
+                                        }
+                                    }
+                                });
+                            }
+
+                            @Override
+                            public void fail(ErrorCode errorCode) {
+                                trigger.fail(errorCode);
+                            }
+                        });
+                    }
+
+                    @Override
+                    public void rollback(FlowRollback trigger, Map data) {
+                        if (StringUtils.isBlank(ensuredTpmUuid)) {
+                            trigger.rollback();
+                            return;
+                        }
+
+                        try {
+                            tpmKeyBackend.detachKeyProviderFromTpm(ensuredTpmUuid);
+                        } catch (Throwable t) {
+                            logger.warn(String.format("failed to detach key provider from tpm[uuid:%s] during migrate rollback, %s",
+                                    ensuredTpmUuid, t.getMessage()), t);
+                        }
+
+                        trigger.rollback();
+                    }
+                });
+
                 flow(new NoRollbackFlow() {
                     String __name__ = "migrate-vm";