[ https://issues.apache.org/jira/browse/CLOUDSTACK-9875?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16298334#comment-16298334 ]
ASF GitHub Bot commented on CLOUDSTACK-9875: -------------------------------------------- rhtyd closed pull request #2042: CLOUDSTACK-9875: Unable to re-apply Explicit dedication to VM URL: https://github.com/apache/cloudstack/pull/2042 This is a PR merged from a forked repository. As GitHub hides the original diff on merge, it is displayed below for the sake of provenance: As this is a foreign pull request (from a fork), the diff is supplied below (as it won't show otherwise due to GitHub magic): diff --git a/server/src/org/apache/cloudstack/affinity/AffinityGroupServiceImpl.java b/server/src/org/apache/cloudstack/affinity/AffinityGroupServiceImpl.java index f2502442c18..9e3f3c14b80 100644 --- a/server/src/org/apache/cloudstack/affinity/AffinityGroupServiceImpl.java +++ b/server/src/org/apache/cloudstack/affinity/AffinityGroupServiceImpl.java @@ -432,12 +432,23 @@ public UserVm updateVMAffinityGroups(Long vmId, List<Long> affinityGroupIds) { throw new InvalidParameterValueException("Unable to find affinity group by id " + affinityGroupId); } else { // verify permissions - _accountMgr.checkAccess(caller, null, true, owner, ag); - // Root admin has access to both VM and AG by default, but make sure the - // owner of these entities is same - if (caller.getId() == Account.ACCOUNT_ID_SYSTEM || _accountMgr.isRootAdmin(caller.getId())) { - if (ag.getAccountId() != owner.getAccountId()) { - throw new PermissionDeniedException("Affinity Group " + ag + " does not belong to the VM's account"); + if (ag.getAclType() == ACLType.Domain) { + _accountMgr.checkAccess(caller, null, false, owner, ag); + // make sure the affinity group is available in that domain + if (caller.getId() == Account.ACCOUNT_ID_SYSTEM || _accountMgr.isRootAdmin(caller.getId())) { + if (!isAffinityGroupAvailableInDomain(ag.getId(), owner.getDomainId())) { + throw new PermissionDeniedException("Affinity Group " + ag + " does not belong to the VM's domain"); + } + } + } else { + _accountMgr.checkAccess(caller, null, true, owner, ag); + // Root admin has access to both VM and AG by default, + // but + // make sure the owner of these entities is same + if (caller.getId() == Account.ACCOUNT_ID_SYSTEM || _accountMgr.isRootAdmin(caller.getId())) { + if (ag.getAccountId() != owner.getAccountId()) { + throw new PermissionDeniedException("Affinity Group " + ag + " does not belong to the VM's account"); + } } } } ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org > Unable to re-apply Explicit dedication to VM > -------------------------------------------- > > Key: CLOUDSTACK-9875 > URL: https://issues.apache.org/jira/browse/CLOUDSTACK-9875 > Project: CloudStack > Issue Type: Bug > Security Level: Public(Anyone can view this level - this is the > default.) > Components: Management Server > Reporter: Harikrishna Patnala > Assignee: Harikrishna Patnala > Fix For: 4.11.0.0 > > > When a VM is deployed with in an Affinity group which has the cluster > dedicated to a subdomain (zone is dedicated to parent domain) it is getting > successful. We can also stop the vm and remove the affinity group, but if you > want to add back the affinity it is failing. > Following are the steps to reproduce > 1. I had created a Domain (Glass SA Parent Domain) and under it a subdomain > (Glass SA Subdomain) and created an account to it. > 2. Apply dedication to the zone for primary domain (Glass SA Parent Domain) > 3. Apply dedication to the cluster for sub domain (Glass SA Subdomain) > 4. Logged in with the Account of Subdomain. > 5. Created an instance with the affinity (DedicatedGrp-domain-Glass SA > Subdomain) - the dedication set with the cluster for the subdomain. > 6. Powered off the VM, removed the affinity. > 7. Tried adding back (the cluster affinity subdomain) - gives the error > "Entity affinity Group () and entity Acct () belong to different accounts" -- This message was sent by Atlassian JIRA (v6.4.14#64029)