November 2024 Security and Maintenance Update for XCP-ng 8.2 LTS

Gaël Duperrey -

New bugfix, enhancement and security updates are available for XCP-ng 8.2 LTS.

📔
To update, follow this guide. You can also join the discussion on our community forum. Host reboots are necessary after this update.

📋 Summary

We usually queue non-critical fixes or improvements for a grouped release, to avoid unnecessary maintenance tasks on your pools. This is one such grouped release, grouped along with a set of security updates.

⚠️
Given this groups maintenance updates and security updates, it is strongly advised for all users to update their hosts.

🔒 Security Updates

✨ What changed

This update also brings non-urgent bugfixes, compatibility improvements, as well as some small enhancements, to a variety of components.

XAPI

In XCP-ng, XAPI is the core API and toolset that enables the management of virtual machines, networking, storage, and resource allocation.

We synchronized XAPI with Citrix Hypervisor 8.2 CU1 hotfix XS82ECU1074:

  • Enhancement: robustification of the command xe host-emergency-ha-disable
  • Correction of different issues:
    • Performing a hard shutdown of a VM may hang due to unnecessary RBCA permission checks. An icon (yellow triangle) may then be displayed on some management applications, indicating that the shutdown process did not complete successfully.
    • Canceling a hard shutdown of a hung VM fails because the cancel function only checks for proper shutdowns.
    • Migrating VMs from 8.2.1 to 8.3 with the xe vm-migrate command may fail with the error 'Failure: Unknown tag/contents'.
    • You may encounter a 500 error (internal server error) when trying to retrieve RRD measurements from a powered off virtual machine.

blktap

blktap is a user-level disk I/O interface.

Synchronized with Citrix Hypervisor 8.2 CU1 hotfix XS82ECU1075: Improvements on coalesce performance.

sm

sm is the default Storage Management stack supported by the XAPI that contains a plugin set of different storage layers (NFS, ext4, LVM...).

  • Synchronized with Citrix Hypervisor 8.2 CU1 hotfix XS82ECU1075:
    • Updated multipath.conf for several SANs
    • Fix for CA-393194: Find the real PV in a VG before removing the VG.

🪲 Others bugfixes and improvements

  • guest-templates-json:
    • Add generic templates for Linux BIOS and UEFI.
    • Synchronized with hotfix XS82ECU1085:
      • Oracle 8 requires minimum 2 vCPUS.
      • Added template for Ubuntu 24.04
  • xcp-ng-xapi-plugins: Enhance error reporting when a command run on a host fails.
  • xenserver-status-report: Update to latest version, synchronized with XS82ECU1058.
  • python-defusedxml: Added as a new dependency of xenserver-status-report.
  • xsconsole: Synchronized with hotfix XS82ECU1074: Fix for a time-out when creating an iSCSI SR.
  • zstd: Update to version 1.5.5 to avoid an extremely rare case of corruption.

🔧 Updates for alternate drivers

As explained in our documentation, XCP-ng occasionally provides alternate drivers for users who have issues with the main drivers installed with XCP-ng. We just released two updates, rebuilt from the driver disks published by XenServer for Citrix Hypervisor 8.2 CU1. We added a newer version of an existing driver, based on manufacturer sources:

  • intel-i40e-alt: From version 2.22.20-3.1 to 2.22.20-5.1
  • mellanox-mlnxen-alt: From version 5.9.0.5.5.0-1.1 to 5.9.0.5.5.0-1.2
  • New alternate driver mlx4-modules-alt: To resolve some issues with CX3 cards and SR-IOV, we added an updated version 4.9-7.1.0.0-LTS of this driver.

You can consult the list of drivers with an alternate version on Github.

🔧 Update for alternate kernel

Backport of a fix to correct cooling fan rotation speed on some Lenovo servers. For more information, you can read this thread on the forum.