qcloud elb bugfix

pkg/compute/models/disks.go

@@ -1195,7 +1195,7 @@ func (self *SDisk) syncRemoveCloudDisk(ctx context.Context, userCred mcclient.To
 		return err
 	}
 	_, err = iregion.GetIDiskById(self.ExternalId)
-	if err != cloudprovider.ErrNotFound {
+	if err != nil && err != cloudprovider.ErrNotFound {
 		return err
 	}
 

pkg/compute/models/guests.go

@@ -2036,7 +2036,7 @@ func (self *SGuest) syncRemoveCloudVM(ctx context.Context, userCred mcclient.Tok
 		return err
 	}
 	_, err = iregion.GetIVMById(self.ExternalId)
-	if err != cloudprovider.ErrNotFound {
+	if err != nil && err != cloudprovider.ErrNotFound {
 		return err
 	}
 

pkg/compute/models/loadbalanceracls.go

@@ -221,17 +221,6 @@ func (lbacl *SLoadbalancerAcl) PostUpdate(ctx context.Context, userCred mcclient
 	for i := range acls {
 		acl := acls[i]
 		acl.SetModelManager(CachedLoadbalancerAclManager, &acl)
-		_, err = db.UpdateWithLock(ctx, &acl, func() error {
-			acl.AclEntries = &SLoadbalancerAclEntries{}
-			for _, entry := range *lbacl.AclEntries {
-				*acl.AclEntries = append(*acl.AclEntries, entry)
-			}
-			return nil
-		})
-		if err != nil {
-			log.Errorf("SLoadbalancerAcl PostUpdate %s", err)
-		}
-
 		err = acl.StartLoadBalancerAclSyncTask(ctx, userCred, "")
 		if err != nil {
 			log.Errorf("SLoadbalancerAcl PostUpdate %s", err)
@@ -312,6 +301,7 @@ func (lbacl *SLoadbalancerAcl) PerformPatch(ctx context.Context, userCred mcclie
 		}
 	}
 	diff, err := db.Update(lbacl, func() error {
+		// todo: sync diff to clouds
 		lbacl.AclEntries = &aclEntries
 		return nil
 	})

pkg/compute/models/loadbalancercachedacls.go

@@ -20,7 +20,7 @@ import (
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
-	"yunion.io/x/pkg/gotypes"
+	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/compare"
 	"yunion.io/x/sqlchemy"
 
@@ -60,9 +60,8 @@ type SCachedLoadbalancerAcl struct {
 	SManagedResourceBase
 	SCloudregionResourceBase
 
-	AclId      string                   `width:"128" charset:"ascii" nullable:"false" index:"true" list:"user" create:"required"` // 本地ACL ID
-	AclEntries *SLoadbalancerAclEntries `list:"user" update:"user" nullable:"true"  create:"optional"`
-	ListenerId string                   `width:"36" charset:"ascii" nullable:"true" list:"user" create:"optional"` // huawei only
+	AclId      string `width:"128" charset:"ascii" nullable:"false" index:"true" list:"user" create:"required"` // 本地ACL ID
+	ListenerId string `width:"36" charset:"ascii" nullable:"true" list:"user" create:"optional"`                // huawei only
 }
 
 func (lbacl *SCachedLoadbalancerAcl) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -216,61 +215,6 @@ func (lbacl *SCachedLoadbalancerAcl) AllowPerformPatch(ctx context.Context, user
 	return lbacl.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lbacl, "patch")
 }
 
-// PerformPatch patches acl entries by adding then deleting the specified acls.
-// This is intended mainly for command line operations.
-func (lbacl *SCachedLoadbalancerAcl) PerformPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
-	aclEntries := gotypes.DeepCopy(*lbacl.AclEntries).(SLoadbalancerAclEntries)
-	{
-		adds := SLoadbalancerAclEntries{}
-		addsV := validators.NewStructValidator("adds", &adds)
-		addsV.Optional(true)
-		err := addsV.Validate(data)
-		if err != nil {
-			return nil, err
-		}
-		for _, add := range adds {
-			found := false
-			for _, aclEntry := range aclEntries {
-				if aclEntry.Cidr == add.Cidr {
-					found = true
-					aclEntry.Comment = add.Comment
-					break
-				}
-			}
-			if !found {
-				aclEntries = append(aclEntries, add)
-			}
-		}
-	}
-	{
-		dels := SLoadbalancerAclEntries{}
-		delsV := validators.NewStructValidator("dels", &dels)
-		delsV.Optional(true)
-		err := delsV.Validate(data)
-		if err != nil {
-			return nil, err
-		}
-		for _, del := range dels {
-			for i := len(aclEntries) - 1; i >= 0; i-- {
-				aclEntry := aclEntries[i]
-				if aclEntry.Cidr == del.Cidr {
-					aclEntries = append(aclEntries[:i], aclEntries[i+1:]...)
-					break
-				}
-			}
-		}
-	}
-	diff, err := db.Update(lbacl, func() error {
-		lbacl.AclEntries = &aclEntries
-		return nil
-	})
-	if err != nil {
-		return nil, err
-	}
-	db.OpsLog.LogEvent(lbacl, db.ACT_UPDATE, diff, userCred)
-	return nil, nil
-}
-
 func (lbacl *SCachedLoadbalancerAcl) ValidateDeleteCondition(ctx context.Context) error {
 	man := LoadbalancerListenerManager
 	t := man.TableSpec().Instance()
@@ -329,7 +273,7 @@ func (self *SCachedLoadbalancerAcl) syncRemoveCloudLoadbalanceAcl(ctx context.Co
 	} else {
 		self.DoPendingDelete(ctx, userCred)
 	}
-	return err
+	return errors.Wrap(err, "cachedLoadbalancerAcl.remove.Delete")
 }
 
 func (acl *SCachedLoadbalancerAcl) SyncWithCloudLoadbalancerAcl(ctx context.Context, userCred mcclient.TokenCredential, extAcl cloudprovider.ICloudLoadbalancerAcl, projectId mcclient.IIdentityProvider) error {
@@ -342,21 +286,17 @@ func (acl *SCachedLoadbalancerAcl) SyncWithCloudLoadbalancerAcl(ctx context.Cont
 			if len(ext_listener_id) > 0 {
 				ilistener, err := db.FetchByExternalId(LoadbalancerListenerManager, ext_listener_id)
 				if err != nil {
-					return err
+					return errors.Wrap(err, "cacheLoadbalancerAcl.sync.FetchByExternalId")
 				}
 
 				acl.ListenerId = ilistener.(*SLoadbalancerListener).GetId()
 			}
 		}
 
-		acl.AclEntries = &SLoadbalancerAclEntries{}
-		for _, entry := range extAcl.GetAclEntries() {
-			*acl.AclEntries = append(*acl.AclEntries, &SLoadbalancerAclEntry{Cidr: entry.CIDR, Comment: entry.Comment})
-		}
 		return nil
 	})
 	if err != nil {
-		return err
+		return errors.Wrap(err, "cacheLoadbalancerAcl.sync.Update")
 	}
 	db.OpsLog.LogSyncUpdate(acl, diff, userCred)
 
@@ -382,7 +322,6 @@ func (man *SCachedLoadbalancerAclManager) GetOrCreateCachedAcl(ctx context.Conte
 			_, err := man.TableSpec().Update(&lbacl, func() error {
 				lbacl.Name = acl.Name
 				lbacl.AclId = acl.Id
-				lbacl.AclEntries = acl.AclEntries
 				return nil
 			})
 
@@ -404,7 +343,6 @@ func (man *SCachedLoadbalancerAclManager) GetOrCreateCachedAcl(ctx context.Conte
 	lbacl.ProjectSrc = lblis.ProjectSrc
 	lbacl.Name = acl.Name
 	lbacl.AclId = acl.Id
-	lbacl.AclEntries = acl.AclEntries
 	lbacl.ListenerId = listenerId
 
 	err = man.TableSpec().Insert(&lbacl)
@@ -412,12 +350,7 @@ func (man *SCachedLoadbalancerAclManager) GetOrCreateCachedAcl(ctx context.Conte
 		return nil, err
 	}
 
-	lbacl, err = man.getLoadbalancerAclByRegion(provider, lblis.CloudregionId, acl.Id, listenerId)
-	if err == nil {
-		return &lbacl, nil
-	}
-
-	return nil, err
+	return &lbacl, err
 }
 
 func (man *SCachedLoadbalancerAclManager) getLoadbalancerAclsByRegion(region *SCloudregion, provider *SCloudprovider) ([]SCachedLoadbalancerAcl, error) {
@@ -514,24 +447,24 @@ func (man *SCachedLoadbalancerAclManager) newFromCloudLoadbalancerAcl(ctx contex
 
 	newName, err := db.GenerateName(man, projectId, extAcl.GetName())
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, "cachedLoadbalancerAclManager.new.GenerateName")
 	}
 	acl.ExternalId = extAcl.GetGlobalId()
 	acl.Name = newName
 	acl.ManagerId = provider.Id
 	acl.CloudregionId = region.Id
 
-	acl.AclEntries = &SLoadbalancerAclEntries{}
+	aclEntites := SLoadbalancerAclEntries{}
 	for _, entry := range extAcl.GetAclEntries() {
-		*acl.AclEntries = append(*acl.AclEntries, &SLoadbalancerAclEntry{Cidr: entry.CIDR, Comment: entry.Comment})
+		aclEntites = append(aclEntites, &SLoadbalancerAclEntry{Cidr: entry.CIDR, Comment: entry.Comment})
 	}
 
-	f := acl.AclEntries.Fingerprint()
+	f := aclEntites.Fingerprint()
 	if LoadbalancerAclManager.CountByFingerPrint(f) == 0 {
 		localAcl := SLoadbalancerAcl{}
 		localAcl.Name = acl.Name
 		localAcl.Description = acl.Description
-		localAcl.AclEntries = acl.AclEntries
+		localAcl.AclEntries = &aclEntites
 		localAcl.Fingerprint = f
 		// usercread
 		localAcl.DomainId = userCred.GetProjectDomainId()
@@ -539,14 +472,14 @@ func (man *SCachedLoadbalancerAclManager) newFromCloudLoadbalancerAcl(ctx contex
 		localAcl.ProjectSrc = string(db.PROJECT_SOURCE_CLOUD)
 		err := LoadbalancerAclManager.TableSpec().Insert(&localAcl)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, "cachedLoadbalancerAclManager.new.InsertAcl")
 		}
 	}
 
 	{
 		localAcl, err := LoadbalancerAclManager.FetchByFingerPrint(f)
 		if err != nil {
-			return nil, err
+			return nil, errors.Wrap(err, "cachedLoadbalancerAclManager.new.FetchByFingerPrint")
 		}
 
 		acl.AclId = localAcl.GetId()
@@ -555,7 +488,7 @@ func (man *SCachedLoadbalancerAclManager) newFromCloudLoadbalancerAcl(ctx contex
 	err = man.TableSpec().Insert(&acl)
 	if err != nil {
 		log.Errorf("newFromCloudLoadbalancerAcl fail %s", err)
-		return nil, err
+		return nil, errors.Wrap(err, "cachedLoadbalancerAclManager.new.InsertCachedAcl")
 	}
 
 	SyncCloudProject(userCred, &acl, projectId, extAcl, acl.ManagerId)

pkg/compute/models/loadbalancercachedcertificates.go

@@ -18,21 +18,21 @@ import (
 	"context"
 	"database/sql"
 	"fmt"
-	"time"
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
-	"yunion.io/x/onecloud/pkg/cloudcommon/validators"
+	"yunion.io/x/pkg/errors"
+	"yunion.io/x/pkg/util/compare"
 	"yunion.io/x/sqlchemy"
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/taskman"
+	"yunion.io/x/onecloud/pkg/cloudcommon/validators"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
 	"yunion.io/x/onecloud/pkg/httperrors"
 	"yunion.io/x/onecloud/pkg/mcclient"
-	"yunion.io/x/pkg/util/compare"
 )
 
 type SCachedLoadbalancerCertificateManager struct {
@@ -62,18 +62,6 @@ type SCachedLoadbalancerCertificate struct {
 	SCloudregionResourceBase // Region ID
 
 	CertificateId string `width:"128" charset:"ascii" nullable:"false" create:"required"  index:"true" list:"user"` // 本地证书ID
-	Certificate   string `create:"required" list:"user" update:"user"`
-	PrivateKey    string `create:"required" list:"admin" update:"user"`
-
-	// derived attributes
-	PublicKeyAlgorithm      string    `create:"optional" list:"user" update:"user"`
-	PublicKeyBitLen         int       `create:"optional" list:"user" update:"user"`
-	SignatureAlgorithm      string    `create:"optional" list:"user" update:"user"`
-	Fingerprint             string    `create:"optional" list:"user" update:"user"`
-	NotBefore               time.Time `create:"optional" list:"user" update:"user"`
-	NotAfter                time.Time `create:"optional" list:"user" update:"user"`
-	CommonName              string    `create:"optional" list:"user" update:"user"`
-	SubjectAlternativeNames string    `create:"optional" list:"user" update:"user"`
 }
 
 func (self *SCachedLoadbalancerCertificate) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool {
@@ -243,7 +231,7 @@ func (man *SCachedLoadbalancerCertificateManager) GetOrCreateCachedCertificate(c
 	}
 
 	if err.Error() != "NotFound" {
-		return nil, err
+		return nil, errors.Wrap(err, "cachedLoadbalancerCertificateManager.getCert")
 	}
 
 	lbcert = SCachedLoadbalancerCertificate{}
@@ -254,30 +242,14 @@ func (man *SCachedLoadbalancerCertificateManager) GetOrCreateCachedCertificate(c
 	lbcert.Name = cert.Name
 	lbcert.Description = cert.Description
 	lbcert.IsSystem = cert.IsSystem
-	lbcert.Certificate = cert.Certificate
 	lbcert.CertificateId = cert.Id
-	lbcert.Certificate = cert.Certificate
-	lbcert.PrivateKey = cert.PrivateKey
-	lbcert.PublicKeyAlgorithm = cert.PublicKeyAlgorithm
-	lbcert.PublicKeyBitLen = cert.PublicKeyBitLen
-	lbcert.SignatureAlgorithm = cert.SignatureAlgorithm
-	lbcert.Fingerprint = cert.Fingerprint
-	lbcert.NotBefore = cert.NotBefore
-	lbcert.NotAfter = cert.NotAfter
-	lbcert.CommonName = cert.CommonName
-	lbcert.SubjectAlternativeNames = cert.SubjectAlternativeNames
 
 	err = man.TableSpec().Insert(&lbcert)
 	if err != nil {
-		return nil, err
+		return nil, errors.Wrap(err, "cachedLoadbalancerCertificateManager.create")
 	}
 
-	lbcert, err = man.getLoadbalancerCertificateByRegion(provider, lblis.CloudregionId, cert.Id)
-	if err == nil {
-		return &lbcert, nil
-	}
-
-	return nil, err
+	return &lbcert, nil
 }
 
 func (lbcert *SCachedLoadbalancerCertificate) StartLoadbalancerCertificateCreateTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error {
@@ -302,22 +274,13 @@ func (man *SCachedLoadbalancerCertificateManager) newFromCloudLoadbalancerCertif
 	lbcert.ManagerId = provider.Id
 	lbcert.CloudregionId = region.Id
 
-	lbcert.CommonName = extCertificate.GetCommonName()
-	lbcert.SubjectAlternativeNames = extCertificate.GetSubjectAlternativeNames()
-	lbcert.Fingerprint = extCertificate.GetFingerprint()
-	lbcert.NotAfter = extCertificate.GetExpireTime()
-	lbcert.Certificate = extCertificate.GetPublickKey()
-	lbcert.PrivateKey = extCertificate.GetPrivateKey()
-
-	// check local cert
-	// todo: check fingerprint not empty & aws 证书不区分region，需要去除重复数据？
-	c := SCachedLoadbalancerCertificate{}
-	q1 := CachedLoadbalancerCertificateManager.Query().IsFalse("pending_deleted").Equals("fingerprint", lbcert.Fingerprint)
+	c := SLoadbalancerCertificate{}
+	q1 := LoadbalancerCertificateManager.Query().IsFalse("pending_deleted").Equals("fingerprint", extCertificate.GetFingerprint())
 	err = q1.First(&c)
 	if err != nil {
 		switch err {
 		case sql.ErrNoRows:
-			localcert, err := LoadbalancerCertificateManager.CreateCertificate(userCred, lbcert.Name, lbcert.Certificate, lbcert.PrivateKey, lbcert.Fingerprint)
+			localcert, err := LoadbalancerCertificateManager.CreateCertificate(userCred, lbcert.Name, extCertificate.GetPublickKey(), extCertificate.GetPrivateKey(), extCertificate.GetFingerprint())
 			if err != nil {
 				return nil, fmt.Errorf("newFromCloudLoadbalancerCertificate CreateCertificate %s", err)
 			}
@@ -327,7 +290,7 @@ func (man *SCachedLoadbalancerCertificateManager) newFromCloudLoadbalancerCertif
 			return nil, fmt.Errorf("newFromCloudLoadbalancerCertificate.QueryCachedLoadbalancerCertificate %s", err)
 		}
 	} else {
-		lbcert.CertificateId = c.CertificateId
+		lbcert.CertificateId = c.Id
 	}
 
 	err = man.TableSpec().Insert(&lbcert)
@@ -347,10 +310,6 @@ func (lbcert *SCachedLoadbalancerCertificate) SyncWithCloudLoadbalancerCertifica
 	diff, err := db.UpdateWithLock(ctx, lbcert, func() error {
 		lbcert.ExternalId = extCertificate.GetGlobalId()
 		lbcert.Name = extCertificate.GetName()
-		lbcert.CommonName = extCertificate.GetCommonName()
-		lbcert.SubjectAlternativeNames = extCertificate.GetSubjectAlternativeNames()
-		lbcert.Fingerprint = extCertificate.GetFingerprint()
-		lbcert.NotAfter = extCertificate.GetExpireTime()
 		return nil
 	})
 	if err != nil {
@@ -384,18 +343,21 @@ func (man *SCachedLoadbalancerCertificateManager) getLoadbalancerCertificateByRe
 		return SCachedLoadbalancerCertificate{}, err
 	}
 
-	if len(certificates) == 1 {
+	if len(certificates) >= 1 {
 		return certificates[0], nil
-	} else if len(certificates) == 0 {
-		return SCachedLoadbalancerCertificate{}, fmt.Errorf("NotFound")
 	} else {
-		return SCachedLoadbalancerCertificate{}, fmt.Errorf("Duplicate certificate %s found for region %s", localCertificateId, regionId)
+		return SCachedLoadbalancerCertificate{}, fmt.Errorf("NotFound")
 	}
 }
 
 func (man *SCachedLoadbalancerCertificateManager) getLoadbalancerCertificatesByRegion(region *SCloudregion, provider *SCloudprovider) ([]SCachedLoadbalancerCertificate, error) {
 	certificates := []SCachedLoadbalancerCertificate{}
-	q := man.Query().Equals("cloudregion_id", region.Id).Equals("manager_id", provider.Id).IsFalse("pending_deleted")
+	q := man.Query().Equals("manager_id", provider.Id).IsFalse("pending_deleted")
+	// aws 所有region共用一份证书.与region无关
+	if region.GetProviderName() != api.CLOUD_PROVIDER_AWS {
+		q = q.Equals("cloudregion_id", region.Id)
+	}
+
 	if err := db.FetchModelObjects(man, q, &certificates); err != nil {
 		log.Errorf("failed to get lb certificates for region: %v provider: %v error: %v", region, provider, err)
 		return nil, err

pkg/compute/models/loadbalancercertificates.go

@@ -323,7 +323,7 @@ func (man *SLoadbalancerCertificateManager) CreateCertificate(userCred mcclient.
 	data.Set("fingerprint", jsonutils.NewString(fingerprint))
 	q := man.Query().Equals("fingerprint", fingerprint).Asc("created_at").IsFalse("pending_deleted")
 	count, err := q.CountWithError()
-	if err != sql.ErrNoRows {
+	if err != nil && err != sql.ErrNoRows {
 		return nil, err
 	}
 

pkg/compute/models/loadbalancerlisteners.go

@@ -404,7 +404,7 @@ func (lblis *SLoadbalancerListener) GetCustomizeColumns(ctx context.Context, use
 	}
 
 	if len(lblis.CertificateId) > 0 {
-		if cert := lblis.GetLoadbalancerCertificate(); cert != nil {
+		if cert, _ := lblis.GetLoadbalancerCertificate(); cert != nil {
 			extra.Set("certificate_name", jsonutils.NewString(cert.Name))
 			extra.Set("origin_certificate_id", jsonutils.NewString(cert.CertificateId))
 		}
@@ -530,7 +530,9 @@ func (lblis *SLoadbalancerListener) GetLoadbalancerListenerParams() (*cloudprovi
 		listener.AccessControlListID = acl.ExternalId
 		listener.AccessControlListType = lblis.AclType
 	}
-	if certificate := lblis.GetLoadbalancerCertificate(); certificate != nil && lblis.ListenerType == api.LB_LISTENER_TYPE_HTTPS {
+	if certificate, err := lblis.GetLoadbalancerCertificate(); err != nil {
+		return nil, errors.Wrap(err, "SLoadbalancerListener.GetLoadbalancerListenerParams.certificate")
+	} else if certificate != nil && lblis.ListenerType == api.LB_LISTENER_TYPE_HTTPS {
 		listener.CertificateID = certificate.ExternalId
 	}
 
@@ -607,18 +609,22 @@ func (lblis *SLoadbalancerListener) GetAwsLoadbalancerListenerParams() (*cloudpr
 	return listener, nil
 }
 
-func (lblis *SLoadbalancerListener) GetLoadbalancerCertificate() *SCachedLoadbalancerCertificate {
+func (lblis *SLoadbalancerListener) GetLoadbalancerCertificate() (*SCachedLoadbalancerCertificate, error) {
 	if len(lblis.CachedCertificateId) == 0 {
-		return nil
+		return nil, nil
 	}
 
 	ret := &SCachedLoadbalancerCertificate{}
 	err := CachedLoadbalancerCertificateManager.Query().Equals("id", lblis.CachedCertificateId).Equals("cloudregion_id", lblis.CloudregionId).IsFalse("pending_deleted").First(ret)
 	if err != nil {
-		return nil
+		if err == sql.ErrNoRows {
+			return nil, nil
+		}
+
+		return nil, err
 	}
 
-	return ret
+	return ret, nil
 }
 
 func (lblis *SLoadbalancerListener) GetCachedLoadbalancerAcl() *SCachedLoadbalancerAcl {

pkg/compute/regiondrivers/managedvirtual.go

@@ -346,11 +346,18 @@ func (self *SManagedVirtualizationRegionDriver) syncLoadbalancerAcl(ctx context.
 		return nil, fmt.Errorf("regionDriver.syncLoadbalancerAcl %s", err)
 	}
 
-	if lbacl.AclEntries != nil {
-		for _, entry := range *lbacl.AclEntries {
+	_localAcl, err := db.FetchById(models.LoadbalancerAclManager, lbacl.AclId)
+	if err != nil {
+		return nil, errors.Wrap(err, "regionDriver.FetchById.LoaclAcl")
+	}
+
+	localAcl := _localAcl.(*models.SLoadbalancerAcl)
+	if localAcl.AclEntries != nil {
+		for _, entry := range *localAcl.AclEntries {
 			acl.Entrys = append(acl.Entrys, cloudprovider.SLoadbalancerAccessControlListEntry{CIDR: entry.Cidr, Comment: entry.Comment})
 		}
 	}
+
 	lockman.LockRawObject(ctx, "acl", lbacl.Id)
 	defer lockman.ReleaseRawObject(ctx, "acl", lbacl.Id)
 
@@ -403,10 +410,17 @@ func (self *SManagedVirtualizationRegionDriver) createLoadbalancerCertificate(ct
 	if err != nil {
 		return nil, errors.Wrapf(err, "lbcert.GetIRegion")
 	}
+
+	_localCert, err := db.FetchById(models.LoadbalancerCertificateManager, lbcert.CertificateId)
+	if err != nil {
+		return nil, errors.Wrapf(err, "regionDriver.FetchById.localcert")
+	}
+
+	localCert := _localCert.(*models.SLoadbalancerCertificate)
 	certificate := &cloudprovider.SLoadbalancerCertificate{
 		Name:        fmt.Sprintf("%s-%s", lbcert.Name, rand.String(4)),
-		PrivateKey:  lbcert.PrivateKey,
-		Certificate: lbcert.Certificate,
+		PrivateKey:  localCert.PrivateKey,
+		Certificate: localCert.Certificate,
 	}
 	iLoadbalancerCert, err := iRegion.CreateILoadBalancerCertificate(certificate)
 	if err != nil {

pkg/multicloud/qcloud/loadbalancer.go

@@ -22,6 +22,7 @@ import (
 
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/log"
+	"yunion.io/x/pkg/utils"
 
 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudprovider"
@@ -480,19 +481,22 @@ func (self *SRegion) CreateLoadbalancerListener(lbid, name, protocol string, por
 		params["ListenerNames.0"] = name
 	}
 
-	if sniSwitch != nil {
-		params["SniSwitch"] = strconv.Itoa(*sniSwitch)
+	if utils.IsInStringArray(protocol, []string{"TCP", "UDP", "TCP_SSL"}) {
+		params = healthCheckParams(LB_TYPE_APPLICATION, params, healthCheck, "HealthCheck.")
+
+		if scheduler != nil && len(*scheduler) > 0 {
+			params["Scheduler"] = *scheduler
+		}
+
+		if sessionExpireTime != nil {
+			params["SessionExpireTime"] = strconv.Itoa(*sessionExpireTime)
+		}
+	} else {
+		if sniSwitch != nil {
+			params["SniSwitch"] = strconv.Itoa(*sniSwitch)
+		}
 	}
 
-	if sessionExpireTime != nil {
-		params["SessionExpireTime"] = strconv.Itoa(*sessionExpireTime)
-	}
-
-	if scheduler != nil && len(*scheduler) > 0 {
-		params["Scheduler"] = *scheduler
-	}
-
-	params = healthCheckParams(LB_TYPE_APPLICATION, params, healthCheck, "HealthCheck.")
 	params = certificateParams(LB_TYPE_APPLICATION, params, cert, "Certificate.")
 
 	resp, err := self.clbRequest("CreateListener", params)

pkg/multicloud/qcloud/loadbalancer_listener.go

@@ -703,8 +703,8 @@ func getCertificate(listener *cloudprovider.SLoadbalancerListener) *certificate
 	if len(listener.CertificateID) > 0 {
 		cert = &certificate{
 			SSLMode:  "UNIDIRECTIONAL",
-			CERTCAID: listener.CertificateID,
-			CERTID:   "",
+			CERTCAID: "",
+			CERTID:   listener.CertificateID,
 		}
 	}