feat(core): restrict libvirt socket access and introduce vlctl tool

[yaroslavborbat]

Description

Restrict libvirt socket access and introduce vlctl tool
This PR enhances security in KubeVirt by restricting virtqemud socket access and introducing vlctl, a new tool to retrieve domain information without using virsh.

Changes

1. Added libvirt patch (002-auth-pid-restriction.patch)

• Introduces the LIBVIRT_UNIX_SOCKET_AUTH_PID environment variable for virtqemud.
• Restricts socket access to a specific process ID, allowing only the specified process to communicate with virtqemud.

2. Added KubeVirt patch (041-restrict-libvirt-socket-to-qemu.patch)

• Configures virtqemud to use the LIBVIRT_UNIX_SOCKET_AUTH_PID environment variable, restricting access to the virt-launcher process that started it.
• Prevents unauthorized processes from connecting to the libvirt socket, reducing security risks.
• Updates the migration mechanism: since virt-handler directly connects to the virtqemud socket during migration, the libvirt patch does not authorize it. To address this issue, an additional migration-proxy has been introduced in virt-launcher. This proxy receives traffic from virt-handler and forwards it to virtqemud.
• A new gRPC call, MigrationProxy, has been added to start this migration proxy.

3. Introduced vlctl tool

• A lightweight alternative to virsh for retrieving domain-related information.
• Provides structured access to domain data, guest info, users, filesystems, and stats.
• Reduces dependencies on virsh, improving efficiency and security.

---

vlctl Command Reference

General Commands

• vlctl ping – Check connectivity with virt-launcher.
• vlctl qemu version – Get the QEMU version.

Domain Commands

• vlctl domain – Get the domain specification.
• vlctl domain stats – Get domain statistics.

Guest Commands

• vlctl guest info – Get general guest info.
• vlctl guest filesystems – Get info about the guest's filesystems.
• vlctl guest users – Get info about logged-in guest users.
• vlctl guest ping – Ping guest agent.

Security Commands

• vlctl sev – Get SEV info.

These commands allow for efficient interaction with virtual machines while improving security and reducing dependency on virsh.

Why do we need it, and what problem does it solve?

These changes strengthen the isolation of QEMU processes, minimize unnecessary socket exposure, and provide a more efficient way to query domain information.

What is the expected result?

Checklist

• The code is covered by unit tests.
• e2e tests passed.
• Documentation updated according to the changes.
• Changes were tested in the Kubernetes cluster manually.

Changelog entries

section: core
type: feature
summary: Enhance security by restricting access to the virtqemud socket, allowing only the virt-launcher to connect.

section: core
type: feature
summary: Introduce the vlctl tool as a replacement for virsh, compatible with the restricted libvirt socket.