Hi all,
I need to move a VM created by admin user of the ROOT domain to a new
account of sub-account (Test-2/user01) but the procedure fails with this
error message:
Failed to move vm Acct[0efe4d3e...] does not have permission to operate
within domain id=165f090c-...
Here it is the Management log:
2019-10-02 10:42:05,222 DEBUG [c.c.a.ApiServer]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) CIDRs from
which account 'Acct[4c0483a8-...-admin]' is allowed to perform API calls:
0.0.0.0/0,::/0
2019-10-02 10:42:05,238 DEBUG [c.c.u.AccountManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Access granted
to Acct[4c0483a8-...-admin] to Domain:4/Test-2/ by AffinityGroupAccessChecker
2019-10-02 10:42:05,256 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
amount of resources of Type = 'user_vm' for Account Name = user01 in Domain Id
= 4 is exceeded: Account Resource Limit = 2, Current Account Resource Amount =
1, Requested Resource Amount = 1.
2019-10-02 10:42:05,258 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
domain resource limits of Type 'user_vm' for Domain Id = 4 is exceeded: Domain
Resource Limit = 3, Current Domain Resource Amount = 1, Requested Resource
Amount = 1.
2019-10-02 10:42:05,265 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
amount of resources of Type = 'cpu' for Account Name = user01 in Domain Id = 4
is exceeded: Account Resource Limit = 2, Current Account Resource Amount = 1,
Requested Resource Amount = 1.
2019-10-02 10:42:05,267 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
domain resource limits of Type 'cpu' for Domain Id = 4 is exceeded: Domain
Resource Limit = 6, Current Domain Resource Amount = 1, Requested Resource
Amount = 1.
2019-10-02 10:42:05,275 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
amount of resources of Type = 'memory' for Account Name = user01 in Domain Id =
4 is exceeded: Account Resource Limit = 2048, Current Account Resource Amount =
1024, Requested Resource Amount = 1024.
2019-10-02 10:42:05,278 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
domain resource limits of Type 'memory' for Domain Id = 4 is exceeded: Domain
Resource Limit = 4096, Current Domain Resource Amount = 1024, Requested
Resource Amount = 1024.
2019-10-02 10:42:05,285 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
amount of resources of Type = 'volume' for Account Name = user01 in Domain Id =
4 is exceeded: Account Resource Limit = 2, Current Account Resource Amount = 1,
Requested Resource Amount = 1.
2019-10-02 10:42:05,287 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
domain resource limits of Type 'volume' for Domain Id = 4 is exceeded: Domain
Resource Limit = 3, Current Domain Resource Amount = 1, Requested Resource
Amount = 1.
2019-10-02 10:42:05,294 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
amount of resources of Type = 'primary_storage' for Account Name = user01 in
Domain Id = 4 is exceeded: Account Resource Limit = 107374182400, Current
Account Resource Amount = 8589934592, Requested Resource Amount = 6442450944.
2019-10-02 10:42:05,296 DEBUG [c.c.r.ResourceLimitManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if
domain resource limits of Type 'primary_storage' for Domain Id = 4 is exceeded:
Domain Resource Limit = 107374182400, Current Domain Resource Amount =
8589934592, Requested Resource Amount = 6442450944.
2019-10-02 10:42:05,300 DEBUG [c.c.u.AccountManagerImpl]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Access to
Acct[4c0483a8-...-admin] granted to Acct[0efe4d3e-...-user01] by DomainChecker
2019-10-02 10:42:05,313 INFO [c.c.a.ApiServer]
(qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Failed to move
vm Acct[0efe4d3e-...-user01] does not have permission to operate within domain
id=165f090c-...
I tryed to do the same procedure with a similar situatuation in a test
environment and it work as aspected...
The main installation is a cloudstack 4.11.2 and the test installation
is a 4.11.3 (both kvm hypervisor).
Where can I look for the problem?
--
*Ugo Vasi* / System Administrator
ugo.v...@procne.it <mailto:ugo.v...@procne.it>
*Procne S.r.l.*
+39 0432 486 523
via Cotonificio, 45
33010 Tavagnacco (UD)
www.procne.it <http://www.procne.it/>
Le informazioni contenute nella presente comunicazione ed i relativi
allegati possono essere riservate e sono, comunque, destinate
esclusivamente alle persone od alla Società sopraindicati. La
diffusione, distribuzione e/o copiatura del documento trasmesso da parte
di qualsiasi soggetto diverso dal destinatario è proibita sia ai sensi
dell'art. 616 c.p., che ai sensi del Decreto Legislativo n. 196/2003
"Codice in materia di protezione dei dati personali". Se avete ricevuto
questo messaggio per errore, vi preghiamo di distruggerlo e di informare
immediatamente Procne S.r.l. scrivendo all' indirizzo e-mail
i...@procne.it <mailto:i...@procne.it>.
