montagnahuanghsiao opened a new issue, #14097: URL: https://github.com/apache/cloudstack/issues/14097
### problem The noVNC console disconnects while the guest VM, Console Proxy VM, CloudStack agent, network connectivity, and KVM VNC backend remain operational. The browser displays: `Failed to connect to server / access token has expired` The console works again after closing the old window and opening a new console session from the CloudStack UI. The newly generated session eventually disconnects again. Observed CPVM log messages include: `Idle timeout expired: 300001/300000 ms` After the disconnection or an attempted reconnection using the previous session: `External authenticator failed` The browser WebSocket initially receives HTTP status 101. The guest VM remains Running, CPVM remains Running with Agent State Up, CPVM TCP 8080 remains reachable, and the KVM VNC listener remains active. The observed traffic path is: Browser → CPVM public interface TCP 8080 → CPVM private interface → KVM VNC endpoint → guest VM ### versions - Apache CloudStack Management Server: 4.22.1.1 - cloudstack-common: 4.22.1.1 - cloudstack-agent: 4.22.1.1 - System VM template/version: 4.22.1.1 - Management Server OS: Ubuntu 24.04 LTS - KVM Host OS: Ubuntu 24.04 LTS - Hypervisor: KVM/libvirt - Host and System VM architecture: aarch64 - Browser: Google Chrome - Zone network type: Advanced - Console Proxy VM state: Running - Console Proxy agent state: Up - `novnc.console.default`: `true` - `consoleproxy.session.timeout`: `300000` No reverse proxy or external load balancer is placed between the browser and the Console Proxy VM. ### The steps to reproduce the bug 1. Deploy and start a guest VM on an aarch64 KVM host. 2. Confirm that the guest VM and Console Proxy VM are Running and their agents are Up. 3. Open the guest console from the CloudStack UI using the default noVNC console. 4. Confirm that the browser WebSocket handshake returns HTTP 101. 5. Keep the console open and observe that it disconnects after approximately 2–5 minutes. 6. Confirm that the guest VM remains Running. 7. Confirm that the CPVM public address and TCP 8080 remain reachable. 8. Confirm that the KVM VNC listener remains active. 9. Observe `Idle timeout expired: 300001/300000 ms` in the CPVM log. 10. Attempt to reuse the old console session and observe `External authenticator failed` or the browser message `Failed to connect to server / access token has expired`. 11. Close the old console window and open the console again from the CloudStack UI. 12. Confirm that the new token restores console access temporarily. ### What to do about it? Expected behavior: An established noVNC console should remain connected according to the configured `consoleproxy.session.timeout` value while the guest VM, Console Proxy VM, network path, and KVM VNC backend remain healthy. Please confirm: 1. Whether this behavior is addressed by PR #13002. 2. Whether that fix is included in any released 4.22 package. 3. Whether a backport to the maintained 4.22 branch is planned. 4. Whether there is a supported workaround for CloudStack 4.22.1.1. 5. Whether `consoleproxy.session.timeout` should control both the Jetty WebSocket idle timeout and Console Proxy viewer garbage collection. 6. Whether applying a changed timeout requires restarting or recreating the Console Proxy VM. Security note: Console URLs, authentication tokens, API credentials, passwords, SSH keys, and sensitive infrastructure identifiers have been removed from this report. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
