cloud-guest-tool: add set-password command via the Qemu Guest Agent

[wido]

Description

This PR adds a set-password command to cloud-guest-tool (the KVM host-side helper that talks to Instances through the Qemu Guest Agent via libvirt).

It resets the password of a user inside a running Instance using QGA's guest-set-user-password command — no password server reachable from the guest and no reset script inside the template required, only a running qemu-guest-agent.

Usage:

# read the new password from stdin (preferred: keeps it out of the process list;
# an interactive terminal gets a no-echo prompt instead)
echo 'S3cret!' | cloud-guest-tool i-2-42-VM --command set-password

# other user, password as argument
cloud-guest-tool i-2-42-VM --command set-password --username admin --password 'S3cret!'

# pre-hashed crypt(3) value, applied verbatim by QGA
cloud-guest-tool i-2-42-VM --command set-password --crypted --password '$6$...'

The password is base64-encoded as the QGA protocol requires. agent_command() gained an optional arguments parameter for this — the first QGA command the tool sends with a payload; the existing info, ping and fstrim commands are unchanged.

Types of changes

• Breaking change (fix or feature that would cause existing functionality to change)
• New feature (non-breaking change which adds functionality)
• Bug fix (non-breaking change which fixes an issue)
• Enhancement (improves an existing feature and functionality)
• Cleanup (Code refactoring and cleanup, that may add test cases)
• build/CI
• test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

• Major
• Minor

How Has This Been Tested?

root@hv-138-d03-21:~# cloudstack-guest-tool --username root --password cloudstack --command set-password i-2-30-VM
{"result": true}
root@hv-138-d03-21:~#

I was now able to login with root/cloudstack into this VM via the console.

[weizhouapache]

lgtm

not tested

[wido]

lgtm

not tested

Thanks. Fairly simple fix for a script which is not in any true code path. Useful for debugging.

In the future we can also think that the "reset password" function of CloudStack does this live on the running VM if the VM supports it on KVM. Should be easy fix. I might open a PR for this as well.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 19.78%. Comparing base (92946e1) to head (1d5e155).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff              @@
##              main   #14080       +/-   ##
============================================
+ Coverage     3.53%   19.78%   +16.24%     
- Complexity       0    19992    +19992     
============================================
  Files          487     6371     +5884     
  Lines        41865   575907   +534042     
  Branches      7913    70496    +62583     
============================================
+ Hits          1479   113928   +112449     
- Misses       40171   449548   +409377     
- Partials       215    12431    +12216     

Flag	Coverage Δ
uitests	3.53% <ø> (ø)
unittests	21.05% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.