Copilot commented on code in PR #13654:
URL: https://github.com/apache/cloudstack/pull/13654#discussion_r3656660843
##########
server/src/main/java/com/cloud/deploy/DeploymentPlanningManagerImpl.java:
##########
@@ -963,8 +963,51 @@ private void findAvoiSetForRouterVM(ExcludeList avoids,
VirtualMachine vm, List<
}
private void findAvoidSetForNonExplicitUserVM(ExcludeList avoids,
VirtualMachine vm, List<Long> allPodsInDc, List<Long> allClustersInDc,
List<Long> allHostsInDc) {
+ long vmAccountId = vm.getAccountId();
+ long vmDomainId = vm.getDomainId();
+
+ List<Long> allPodsFromDedicatedID = new ArrayList<>();
+ List<Long> allClustersFromDedicatedID = new ArrayList<>();
+ List<Long> allHostsFromDedicatedID = new ArrayList<>();
+
+ // If the VM owner's domain has an ExplicitDedication domain-level
affinity group,
+ // resources dedicated to that domain are accessible to the VM owner
(fixes issue #5803).
+ List<AffinityGroupDomainMapVO> domainGroupMappings =
_affinityGroupDomainMapDao.listByDomain(vmDomainId);
+ boolean hasDomainExplicitDedicationGroup = domainGroupMappings != null
&& !domainGroupMappings.isEmpty();
+
Review Comment:
`hasDomainExplicitDedicationGroup` is derived from
`AffinityGroupDomainMapDao.listByDomain(vmDomainId)`, which returns *all*
domain-level affinity groups (of any type). That means any domain-level
affinity group (e.g. non-dedication types) would incorrectly allow access to
domain-dedicated pods/clusters/hosts. If the intent is specifically to allow
domain-dedicated resources only when an `ExplicitDedication` domain-level
affinity group exists, this should check the affinity group type explicitly
(e.g. via `AffinityGroupDao.findDomainLevelGroupByType`).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
