citrix_hypervisor: apply tls_verify to XML-RPC session login

[ian28223]

What does this PR do?

• Passes context=self.get_tls_context() to the ServerProxy used for XenAPI session login in open_session()
• Makes the XML-RPC login honor the same tls_verify/tls_ca_cert instance config already used by the RRD metrics HTTP client, instead of always using Python's default verifying SSL context

Motivation

• ServerProxy(self._base_url) ignored the instance's tls_verify: false setting entirely, since it never went through self.http
• Against a self-signed certificate, this raised [SSL: CERTIFICATE_VERIFY_FAILED] on every check run even with tls_verify: false set, producing noisy, misleading SSL warnings in the Agent log
• This aims to minimize those noisy SSL warnings by making the XML-RPC path consistent with the rest of the check's TLS handling

Review checklist (to be filled by reviewers)

• Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
• Add qa/required if this PR needs QA validation, or qa/skip-qa if it does not. Exactly one of the two is required.
• If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

[datadog-datadog-us1-prod]

 

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

🎯 Code Coverage (details)
• Patch Coverage: 100.00%
• Overall Coverage: 91.07% (+2.48%)

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 4789975 | Docs | View more details | Give us feedback!}

[cit-pr-commenter-54b7da]

evalya-impact-summary

evalya impact analysis

Impact analysis: 0 selected, 0 skipped (of 0 test tasks)
Publish tasks:   1 (always emitted)
Diff (4 files):
  citrix_hypervisor/changelog.d/24909.fixed
  citrix_hypervisor/datadog_checks/citrix_hypervisor/check.py
  citrix_hypervisor/tests/conftest.py
  citrix_hypervisor/tests/test_citrix_hypervisor.py

Debug a specific task: evalya plan impact --path <path> --task <task>

Learn more about CI impact filtering

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 38896c9383

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

[chatgpt-codex-connector]

Verify the TLS login behavior instead

For the self-signed HTTPS scenario this regression test mocks ServerProxy and only inspects the constructed context, so it never verifies the behavior that matters: whether open_session() can complete an XML-RPC login with tls_verify=False. It could pass even if the transport failed to use the context, while also breaking after a behavior-preserving transport refactor; exercise an HTTPS XML-RPC endpoint with a self-signed certificate and assert the session succeeds instead.

AGENTS.md reference: AGENTS.md:L174-L180

Useful? React with 👍 / 👎.

[ian28223]

Good catch — replaced the mocked assertion with a real self-signed HTTPS XML-RPC server (the tls_xenserver fixture in conftest.py, following the same pattern as datadog_checks_base/tests/base/utils/http/test_http.py's openssl_https_server). Two tests now exercise the actual handshake: test_open_session_fails_on_self_signed_cert_by_default and test_open_session_succeeds_with_tls_verify_false. Verified both fail without the context=self.get_tls_context() fix (the "succeeds" test hits the real [SSL: CERTIFICATE_VERIFY_FAILED] error) and pass with it, in commit 4789975.

[dd-octo-sts]

Validation Report

All 21 validations passed.

Show details

Validation	Description	Status
agent-reqs	Verify check versions match the Agent requirements file	✅
ci	Validate CI configuration and code coverage settings	✅
codeowners	Validate every integration has a CODEOWNERS entry	✅
config	Validate default configuration files against spec.yaml	✅
dep	Verify dependency pins are consistent and Agent-compatible	✅
http	Validate integrations use the HTTP wrapper correctly	✅
imports	Validate check imports do not use deprecated modules	✅
integration-style	Validate check code style conventions	✅
jmx-metrics	Validate JMX metrics definition files and config	✅
labeler	Validate PR labeler config matches integration directories	✅
legacy-signature	Validate no integration uses the legacy Agent check signature	✅
license-headers	Validate Python files have proper license headers	✅
licenses	Validate third-party license attribution list	✅
metadata	Validate metadata.csv metric definitions	✅
models	Validate configuration data models match spec.yaml	✅
openmetrics	Validate OpenMetrics integrations disable the metric limit	✅
package	Validate Python package metadata and naming	✅
qa-label	Validate the pull request declares whether it needs QA for the next Agent release	✅
readmes	Validate README files have required sections	✅
saved-views	Validate saved view JSON file structure and fields	✅
version	Validate version consistency between package and changelog	✅

View full run