bug: KVM agent installation removes pki certificates affecting libvirt

[tampler]

ISSUE TYPE

• Bug Report

COMPONENT NAME

Core, Installation

CLOUDSTACK VERSION

4.20, 4.19

CONFIGURATION

OS / ENVIRONMENT

Ubuntu 24.04.1

SUMMARY

When ACS agent is installed, it removes PKI certs from /etc/pki/CA, which causes libvirtd failure:

Cannot read CA certificate '/etc/pki/CA/cacert.pem': No such file or directory
libvirtd.service: Main process exited, code=exited, status=6/NOTCONFIGURED

STEPS TO REPRODUCE

1. Install Ubuntu
2. Install libvirtd
3. Download and install ACS 4.20
4. Restart libvirtd
5. Find the error:  Cannot read CA certificate '/etc/pki/CA/cacert.pem': No such file or directory

EXPECTED RESULTS

KVM agent installed seamlessly

ACTUAL RESULTS

KVM agent is installed but libvirt fails to work without certs

[weizhouapache]

when you added the host to cloudstack, cloudstack agent automatically generated the certificates .
the old certificate is not cloudstack-compatible I think.
so you'd start libvirtd with listen_tcp=1, please refer to
#9562 (comment)