diff --git a/cmd/climc/shell/k8s/releases.go b/cmd/climc/shell/k8s/releases.go index eaa4e41652..e5480029fa 100644 --- a/cmd/climc/shell/k8s/releases.go +++ b/cmd/climc/shell/k8s/releases.go @@ -66,4 +66,22 @@ func initRelease() { _, err := k8s.Releases.Delete(s, args.NAME, args.Params()) return err }) + + R(&o.ReleaseHistoryOptions{}, cmdN("history"), "Get release history", func(s *mcclient.ClientSession, args *o.ReleaseHistoryOptions) error { + ret, err := k8s.Releases.GetSpecific(s, args.NAME, "history", args.Params()) + if err != nil { + return err + } + printObjectYAML(ret) + return nil + }) + + R(&o.ReleaseRollbackOptions{}, cmdN("rollback"), "Rollback release by history revision number", func(s *mcclient.ClientSession, args *o.ReleaseRollbackOptions) error { + ret, err := k8s.Releases.PerformAction(s, args.NAME, "rollback", args.Params()) + if err != nil { + return err + } + printObjectYAML(ret) + return nil + }) } diff --git a/cmd/climc/shell/servers.go b/cmd/climc/shell/servers.go index dbab60769a..5013e7c5c4 100644 --- a/cmd/climc/shell/servers.go +++ b/cmd/climc/shell/servers.go @@ -544,4 +544,35 @@ func init() { printObject(result) return nil }) + + type ServerAddExtraOption struct { + ID string `help:"ID or name of server"` + KEY string `help:"Option key"` + VALUE string `help:"Option value"` + } + R(&ServerAddExtraOption{}, "server-add-extra-options", "Add server extra options", func(s *mcclient.ClientSession, args *ServerAddExtraOption) error { + params := jsonutils.NewDict() + params.Add(jsonutils.NewString(args.KEY), "key") + params.Add(jsonutils.NewString(args.VALUE), "value") + result, err := modules.Servers.PerformAction(s, args.ID, "set-extra-option", params) + if err != nil { + return err + } + printObject(result) + return nil + }) + type ServerRemoveExtraOption struct { + ID string `help:"ID or name of server"` + KEY string `help:"Option key"` + } + R(&ServerRemoveExtraOption{}, "server-remove-extra-options", "Remove server extra options", func(s *mcclient.ClientSession, args *ServerRemoveExtraOption) error { + params := jsonutils.NewDict() + params.Add(jsonutils.NewString(args.KEY), "key") + result, err := modules.Servers.PerformAction(s, args.ID, "del-extra-option", params) + if err != nil { + return err + } + printObject(result) + return nil + }) } diff --git a/pkg/cloudcommon/auth.go b/pkg/cloudcommon/auth.go index c9661ce977..fab8fa949c 100644 --- a/pkg/cloudcommon/auth.go +++ b/pkg/cloudcommon/auth.go @@ -3,13 +3,14 @@ package cloudcommon import ( "fmt" "os" - "time" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/mcclient/auth" ) func InitAuth(options *Options, authComplete auth.AuthCompletedCallback) { + if len(options.AuthURL) == 0 { fmt.Println("Missing AuthURL") os.Exit(1) diff --git a/pkg/cloudcommon/db/db_dispatcher.go b/pkg/cloudcommon/db/db_dispatcher.go index cde358e34e..5c4f76b1b2 100644 --- a/pkg/cloudcommon/db/db_dispatcher.go +++ b/pkg/cloudcommon/db/db_dispatcher.go @@ -65,7 +65,7 @@ func (dispatcher *DBModelDispatcher) Filter(f appsrv.FilterHandler) appsrv.Filte } func fetchUserCredential(ctx context.Context) mcclient.TokenCredential { - token := auth.FetchUserCredential(ctx) + token := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) if token == nil && !consts.IsRbacEnabled() { log.Fatalf("user token credential not found?") } @@ -113,7 +113,7 @@ func listFields(manager IModelManager, userCred mcclient.TokenCredential) []stri if !utils.IsInStringArray(list, []string{"user", "admin", ""}) { log.Warningf("Invalid list value %s for field %s", list, col.Name()) } - if list == "user" || (list == "admin" && userCred.IsSystemAdmin()) { + if list == "user" || (list == "admin" && IsAdminAllowList(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -127,7 +127,7 @@ func searchFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() list := tags["list"] search := tags["search"] - if list == "user" || search == "user" || ((list == "admin" || search == "admin") && userCred.IsSystemAdmin()) { + if list == "user" || search == "user" || ((list == "admin" || search == "admin") && IsAdminAllowList(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -140,7 +140,7 @@ func getDetailFields(manager IModelManager, userCred mcclient.TokenCredential) [ tags := col.Tags() list := tags["list"] get := tags["get"] - if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsSystemAdmin()) { + if list == "user" || get == "user" || ((list == "admin" || get == "admin") && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionGet)) { ret = append(ret, col.Name()) } } @@ -152,7 +152,7 @@ func createRequireFields(manager IModelManager, userCred mcclient.TokenCredentia for _, col := range manager.TableSpec().Columns() { tags := col.Tags() create, _ := tags["create"] - if create == "required" || (create == "admin_required" && userCred.IsSystemAdmin()) { + if create == "required" || (create == "admin_required" && IsAdminAllowCreate(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -166,7 +166,7 @@ func createFields(manager IModelManager, userCred mcclient.TokenCredential) []st tags := col.Tags() create, _ := tags["create"] update := tags["update"] - if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && userCred.IsSystemAdmin()) { + if update == "user" || (update == "admin" && IsAdminAllowCreate(userCred, manager)) || create == "required" || create == "optional" || ((create == "admin_required" || create == "admin_optional") && IsAdminAllowCreate(userCred, manager)) { ret = append(ret, col.Name()) } } @@ -179,7 +179,7 @@ func updateFields(manager IModelManager, userCred mcclient.TokenCredential) []st for _, col := range manager.TableSpec().Columns() { tags := col.Tags() update := tags["update"] - if update == "user" || (update == "admin" && userCred.IsSystemAdmin()) { + if update == "user" || (update == "admin" && userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionUpdate)) { ret = append(ret, col.Name()) } } @@ -315,7 +315,7 @@ func query2List(manager IModelManager, ctx context.Context, userCred mcclient.To } listF := listFields(manager, userCred) fieldFilter := jsonutils.GetQueryStringArray(query, "field") - if len(fieldFilter) > 0 && userCred.IsSystemAdmin() { + if len(fieldFilter) > 0 && IsAdminAllowList(userCred, manager) { // only sysadmin can specify list Fields listF = fieldFilter } @@ -733,7 +733,7 @@ func fetchOwnerProjectId(ctx context.Context, manager IModelManager, userCred mc isAllow = true } } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, "") } if !isAllow { return "", httperrors.NewForbiddenError("Delegation not allowed") diff --git a/pkg/cloudcommon/db/enabledstatusstandalone.go b/pkg/cloudcommon/db/enabledstatusstandalone.go index 1528c09200..6a456a429b 100644 --- a/pkg/cloudcommon/db/enabledstatusstandalone.go +++ b/pkg/cloudcommon/db/enabledstatusstandalone.go @@ -23,7 +23,7 @@ func NewEnabledStatusStandaloneResourceBaseManager(dt interface{}, tableName str } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return IsAdminAllowPerform(userCred, self, "enable") } func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -42,7 +42,7 @@ func (self *SEnabledStatusStandaloneResourceBase) PerformEnable(ctx context.Cont } func (self *SEnabledStatusStandaloneResourceBase) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return IsAdminAllowPerform(userCred, self, "disable") } func (self *SEnabledStatusStandaloneResourceBase) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/interface.go b/pkg/cloudcommon/db/interface.go index e63c2ac02e..aefec45f8b 100644 --- a/pkg/cloudcommon/db/interface.go +++ b/pkg/cloudcommon/db/interface.go @@ -22,6 +22,7 @@ type IModelManager interface { KeywordPlural() string Alias() string AliasPlural() string + SetAlias(alias string, aliasPlural string) ValidateName(name string) error @@ -69,6 +70,8 @@ type IModel interface { GetName() string + KeywordPlural() string + GetModelManager() IModelManager SetModelManager(IModelManager) @@ -164,7 +167,7 @@ type IVirtualModel interface { IStandaloneModel IsOwner(userCred mcclient.TokenCredential) bool - IsAdmin(userCred mcclient.TokenCredential) bool + // IsAdmin(userCred mcclient.TokenCredential) bool } type ISharableVirtualModelManager interface { diff --git a/pkg/cloudcommon/db/jointbase.go b/pkg/cloudcommon/db/jointbase.go index 6dcf2e3c97..17a3276b1d 100644 --- a/pkg/cloudcommon/db/jointbase.go +++ b/pkg/cloudcommon/db/jointbase.go @@ -191,7 +191,7 @@ func (self *SJointResourceBase) AllowGetJointDetails(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) + return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowGet(userCred, master) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowGetDetails(ctx, userCred, query) } @@ -201,7 +201,7 @@ func (self *SJointResourceBase) AllowUpdateJointItem(ctx context.Context, userCr master := item.Master() switch master.(type) { case IVirtualModel: - return master.(IVirtualModel).IsOwner(userCred) + return master.(IVirtualModel).IsOwner(userCred) || IsAdminAllowUpdate(userCred, master) default: // case item implemented customized AllowGetDetails, eg hostjoints return item.AllowUpdateItem(ctx, userCred) } diff --git a/pkg/cloudcommon/db/keystonecache.go b/pkg/cloudcommon/db/keystonecache.go index cfe3cbc45c..306fcef368 100644 --- a/pkg/cloudcommon/db/keystonecache.go +++ b/pkg/cloudcommon/db/keystonecache.go @@ -64,7 +64,7 @@ func NewKeystoneCacheObject(id string, name string, domainId string, domain stri }*/ func (manager *SKeystoneCacheObjectManager) BatchFetchNames(idStrs []string) []string { - t := manager.tableSpec.Instance() + t := manager.TableSpec().Instance() results, err := t.Query(t.Field("name")).In("id", idStrs).AllStringMap() if err != nil { return nil diff --git a/pkg/cloudcommon/db/metadata.go b/pkg/cloudcommon/db/metadata.go index 5c0c98206d..b6ac604efe 100644 --- a/pkg/cloudcommon/db/metadata.go +++ b/pkg/cloudcommon/db/metadata.go @@ -65,7 +65,7 @@ raise Exception('get_object_idstr: failed to generate obj ID') return idstr */ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCred mcclient.TokenCredential) string { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) { return "" } idStr := GetObjectIdstr(model) @@ -78,7 +78,7 @@ func (manager *SMetadataManager) GetStringValue(model IModel, key string, userCr } func (manager *SMetadataManager) GetJsonValue(model IModel, key string, userCred mcclient.TokenCredential) jsonutils.JSONObject { - if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !userCred.IsSystemAdmin()) { + if strings.HasPrefix(key, SYSTEM_ADMIN_PREFIX) && (userCred == nil || !IsAdminAllowGetSpec(userCred, model, "metadata")) { return nil } idStr := GetObjectIdstr(model) @@ -194,7 +194,7 @@ func (manager *SMetadataManager) GetAll(obj IModel, keys []string, userCred mccl for _, rec := range records { if len(rec.Value) > 0 { if strings.HasPrefix(rec.Key, SYSTEM_ADMIN_PREFIX) { - if userCred != nil && userCred.IsSystemAdmin() { + if userCred != nil && IsAdminAllowGetSpec(userCred, obj, "metadata") { key := rec.Key[len(SYSTEM_ADMIN_PREFIX):] ret[key] = rec.Value } diff --git a/pkg/cloudcommon/db/modelbase.go b/pkg/cloudcommon/db/modelbase.go index d4c9a704a9..1af11f2982 100644 --- a/pkg/cloudcommon/db/modelbase.go +++ b/pkg/cloudcommon/db/modelbase.go @@ -151,7 +151,7 @@ func (manager *SModelBaseManager) PerformAction(ctx context.Context, userCred mc } func (manager *SModelBaseManager) AllowPerformCheckCreateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return IsAdminAllowClassPerform(userCred, manager, "check-create-data") } func (manager *SModelBaseManager) InitializeData() error { @@ -178,6 +178,10 @@ func (model *SModelBase) Keyword() string { return model.GetModelManager().Keyword() } +func (model *SModelBase) KeywordPlural() string { + return model.GetModelManager().KeywordPlural() +} + func (model *SModelBase) GetName() string { return "" } diff --git a/pkg/cloudcommon/db/opslog.go b/pkg/cloudcommon/db/opslog.go index 5f58d13642..9e02fefd60 100644 --- a/pkg/cloudcommon/db/opslog.go +++ b/pkg/cloudcommon/db/opslog.go @@ -185,13 +185,6 @@ var _ IModel = (*SOpsLog)(nil) func init() { OpsLog = &SOpsLogManager{NewModelBaseManager(SOpsLog{}, "opslog_tbl", "event", "events")} - -} - -func (manager *SOpsLogManager) SetKeyword(kw, kwPlural string) *SOpsLogManager { - manager.keyword = kw - manager.keywordPlural = kwPlural - return manager } func (opslog *SOpsLog) GetId() string { @@ -304,7 +297,7 @@ func (manager *SOpsLogManager) ListItemFilter(ctx context.Context, q *sqlchemy.S queryDict.RemoveIgnoreCase("action") q = q.Filter(sqlchemy.In(q.Field("action"), action)) } - if !userCred.IsSystemAdmin() { + if !IsAdminAllowList(userCred, manager) { q = q.Filter(sqlchemy.OR(sqlchemy.AND(sqlchemy.IsNotNull(q.Field("owner_tenant_id")), sqlchemy.Equals(q.Field("owner_tenant_id"), userCred.GetProjectId())), sqlchemy.Equals(q.Field("tenant_id"), userCred.GetProjectId()))) } since, _ := query.GetTime("since") @@ -335,7 +328,7 @@ func (manager *SOpsLogManager) AllowCreateItem(ctx context.Context, userCred mcc } func (self *SOpsLog) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId + return IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.ProjectId || userCred.GetProjectId() == self.OwnerProjectId } func (self *SOpsLog) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/quotas/handler.go b/pkg/cloudcommon/db/quotas/handler.go index ed27a32b72..4729168e4f 100644 --- a/pkg/cloudcommon/db/quotas/handler.go +++ b/pkg/cloudcommon/db/quotas/handler.go @@ -72,7 +72,7 @@ func queryQuota(ctx context.Context, projectId string) (*jsonutils.JSONDict, err } func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) params := appctx.AppContextParams(ctx) projectId := params[""] @@ -93,7 +93,7 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request policy.PolicyDelegation, policy.PolicyActionGet) isAllow = result == rbacutils.AdminAllow } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet) } if !isAllow { httperrors.ForbiddenError(w, "not allow to delegate query quota") @@ -133,14 +133,15 @@ func getQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request } func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) var isAllow bool if consts.IsRbacEnabled() { isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), "quotas", policy.PolicyActionUpdate) == rbacutils.AdminAllow } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), + "quotas", policy.PolicyActionUpdate) } if !isAllow { httperrors.ForbiddenError(w, "not allow to set quota") @@ -196,14 +197,15 @@ func setQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request } func checkQuotaHanlder(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) isAllow := false if consts.IsRbacEnabled() { isAllow = policy.PolicyManager.Allow(true, userCred, consts.GetServiceType(), policy.PolicyDelegation, policy.PolicyActionGet) == rbacutils.AdminAllow } else { - isAllow = userCred.IsSystemAdmin() + isAllow = userCred.IsAdminAllow(consts.GetServiceType(), + policy.PolicyDelegation, policy.PolicyActionGet) } if !isAllow { httperrors.ForbiddenError(w, "not allow to delegate check quota") diff --git a/pkg/cloudcommon/db/rbac.go b/pkg/cloudcommon/db/rbac.go index 76c2fd2152..83da4b9753 100644 --- a/pkg/cloudcommon/db/rbac.go +++ b/pkg/cloudcommon/db/rbac.go @@ -122,3 +122,35 @@ func isObjectRbacAllowed(manager IModelManager, model IModel, userCred mcclient. func isJointObjectRbacAllowed(manager IJointModelManager, item IJointModel, userCred mcclient.TokenCredential, action string, extra ...string) bool { return isObjectRbacAllowed(manager, item.Master(), userCred, action, extra...) } + +func IsAdminAllowList(userCred mcclient.TokenCredential, manager IModelManager) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionList) +} + +func IsAdminAllowCreate(userCred mcclient.TokenCredential, manager IModelManager) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionCreate) +} + +func IsAdminAllowClassPerform(userCred mcclient.TokenCredential, manager IModelManager, action string) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), manager.KeywordPlural(), policy.PolicyActionPerform, action) +} + +func IsAdminAllowGet(userCred mcclient.TokenCredential, obj IModel) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet) +} + +func IsAdminAllowGetSpec(userCred mcclient.TokenCredential, obj IModel, spec string) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionGet, spec) +} + +func IsAdminAllowPerform(userCred mcclient.TokenCredential, obj IModel, action string) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionPerform, action) +} + +func IsAdminAllowUpdate(userCred mcclient.TokenCredential, obj IModel) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionUpdate) +} + +func IsAdminAllowDelete(userCred mcclient.TokenCredential, obj IModel) bool { + return userCred.IsAdminAllow(consts.GetServiceType(), obj.KeywordPlural(), policy.PolicyActionDelete) +} \ No newline at end of file diff --git a/pkg/cloudcommon/db/sharablevirtual.go b/pkg/cloudcommon/db/sharablevirtual.go index 8d1cf2db5f..bf048007f4 100644 --- a/pkg/cloudcommon/db/sharablevirtual.go +++ b/pkg/cloudcommon/db/sharablevirtual.go @@ -30,7 +30,7 @@ func (manager *SSharableVirtualResourceBaseManager) FilterByOwner(q *sqlchemy.SQ } func (model *SSharableVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || model.IsPublic + return model.IsOwner(userCred) || model.IsPublic || IsAdminAllowGet(userCred, model) } func (model *SSharableVirtualResourceBase) IsSharable() bool { @@ -38,11 +38,11 @@ func (model *SSharableVirtualResourceBase) IsSharable() bool { } func (model *SSharableVirtualResourceBase) AllowPerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return IsAdminAllowPerform(userCred, model, "public") } func (model *SSharableVirtualResourceBase) AllowPerformPrivate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return IsAdminAllowPerform(userCred, model, "private") } func (model *SSharableVirtualResourceBase) PerformPublic(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/standalone.go b/pkg/cloudcommon/db/standalone.go index d1cb1b4982..cc73447c00 100644 --- a/pkg/cloudcommon/db/standalone.go +++ b/pkg/cloudcommon/db/standalone.go @@ -146,7 +146,7 @@ func (model *SStandaloneResourceBase) GetMetadataJson(key string, userCred mccli } func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error { - if Metadata.IsSystemAdminKey(key) && !userCred.IsSystemAdmin() { + if Metadata.IsSystemAdminKey(key) && !IsAdminAllowPerform(userCred, model, "metadata") { return httperrors.NewNotSufficientPrivilegeError("cannot set system key") } return Metadata.SetValue(ctx, model, key, value, userCred) @@ -154,7 +154,7 @@ func (model *SStandaloneResourceBase) SetMetadata(ctx context.Context, key strin func (model *SStandaloneResourceBase) SetAllMetadata(ctx context.Context, dictstore map[string]interface{}, userCred mcclient.TokenCredential) error { for k := range dictstore { - if Metadata.IsSystemAdminKey(k) && !userCred.IsSystemAdmin() { + if Metadata.IsSystemAdminKey(k) && !IsAdminAllowPerform(userCred, model, "metadata") { return httperrors.NewNotSufficientPrivilegeError("not allow to set system key %s", k) } } @@ -174,7 +174,7 @@ func (model *SStandaloneResourceBase) GetAllMetadata(userCred mcclient.TokenCred } func (model *SStandaloneResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return IsAdminAllowGetSpec(userCred, model, "metadata") } func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -187,7 +187,7 @@ func (model *SStandaloneResourceBase) GetDetailsMetadata(ctx context.Context, us } func (model *SStandaloneResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return IsAdminAllowPerform(userCred, model, "metadata") } func (model *SStandaloneResourceBase) PerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/statusstandalone.go b/pkg/cloudcommon/db/statusstandalone.go index 4304a37388..5d3a6e66b3 100644 --- a/pkg/cloudcommon/db/statusstandalone.go +++ b/pkg/cloudcommon/db/statusstandalone.go @@ -50,7 +50,7 @@ func (model *SStatusStandaloneResourceBase) SetStatus(userCred mcclient.TokenCre } func (model *SStatusStandaloneResourceBase) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return IsAdminAllowPerform(userCred, model, "status") } func (model *SStatusStandaloneResourceBase) PerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/db/taskman/tasks.go b/pkg/cloudcommon/db/taskman/tasks.go index b954d86d08..6cf259966f 100644 --- a/pkg/cloudcommon/db/taskman/tasks.go +++ b/pkg/cloudcommon/db/taskman/tasks.go @@ -70,7 +70,7 @@ type STask struct { } func (manager *STaskManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return true } func (manager *STaskManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -115,7 +115,7 @@ func (manager *STaskManager) FilterByOwner(q *sqlchemy.SQuery, owner string) *sq } func (self *STask) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() || userCred.GetProjectId() == self.UserCred.GetProjectId() + return db.IsAdminAllowGet(userCred, self) || userCred.GetProjectId() == self.UserCred.GetProjectId() } func (self *STask) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { diff --git a/pkg/cloudcommon/db/tenantcache.go b/pkg/cloudcommon/db/tenantcache.go index f2a7aa6068..6b8f4c3f69 100644 --- a/pkg/cloudcommon/db/tenantcache.go +++ b/pkg/cloudcommon/db/tenantcache.go @@ -90,8 +90,8 @@ func (manager *STenantCacheManager) fetchTenantFromKeystone(ctx context.Context, } func (manager *STenantCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*STenant, error) { - lockman.LockRawObject(ctx, manager.keyword, idStr) - defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr) + lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr) + defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr) objo, err := manager.FetchById(idStr) if err != nil && err != sql.ErrNoRows { diff --git a/pkg/cloudcommon/db/usercache.go b/pkg/cloudcommon/db/usercache.go index 1fe3f560c5..7b01d845bc 100644 --- a/pkg/cloudcommon/db/usercache.go +++ b/pkg/cloudcommon/db/usercache.go @@ -53,8 +53,8 @@ func (manager *SUserCacheManager) FetchUserByName(idStr string) (*SUser, error) } func (manager *SUserCacheManager) Save(ctx context.Context, idStr string, name string, domainId string, domain string) (*SUser, error) { - lockman.LockRawObject(ctx, manager.keyword, idStr) - defer lockman.ReleaseRawObject(ctx, manager.keyword, idStr) + lockman.LockRawObject(ctx, manager.KeywordPlural(), idStr) + defer lockman.ReleaseRawObject(ctx, manager.KeywordPlural(), idStr) obj, err := manager.FetchUserById(idStr) if err != nil && err != sql.ErrNoRows { diff --git a/pkg/cloudcommon/db/virtualjointbase.go b/pkg/cloudcommon/db/virtualjointbase.go index e4d6d5bd80..38d46b1ebd 100644 --- a/pkg/cloudcommon/db/virtualjointbase.go +++ b/pkg/cloudcommon/db/virtualjointbase.go @@ -27,7 +27,7 @@ func NewVirtualJointResourceBaseManager(dt interface{}, tableName string, keywor } func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - if jsonutils.QueryBoolean(query, "admin", false) && !userCred.IsSystemAdmin() { + if jsonutils.QueryBoolean(query, "admin", false) && !IsAdminAllowList(userCred, manager) { return false } return true @@ -36,7 +36,7 @@ func (manager *SVirtualJointResourceBaseManager) AllowListItems(ctx context.Cont func (manager *SVirtualJointResourceBaseManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, master IStandaloneModel, query jsonutils.JSONObject) bool { masterVirtual := master.(IVirtualModel) - if masterVirtual.IsOwner(userCred) { + if masterVirtual.IsOwner(userCred) || IsAdminAllowList(userCred, manager) { return true } return false @@ -62,12 +62,12 @@ func (manager *SVirtualJointResourceBaseManager) AllowAttach(ctx context.Context func (self *SVirtualJointResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) + return masterVirtual.IsOwner(userCred) || IsAdminAllowGet(userCred, self) } func (self *SVirtualJointResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { masterVirtual := self.Master().(IVirtualModel) - return masterVirtual.IsOwner(userCred) + return masterVirtual.IsOwner(userCred) || IsAdminAllowUpdate(userCred, self) } func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -96,7 +96,7 @@ func (manager *SVirtualJointResourceBaseManager) ListItemFilter(ctx context.Cont sqlchemy.IsFalse(masterTable.Field("deleted")))) q = q.Join(slaveTable, sqlchemy.AND(sqlchemy.Equals(slaveField, slaveTable.Field("id")), sqlchemy.IsFalse(slaveTable.Field("deleted")))) - if jsonutils.QueryBoolean(query, "admin", false) && userCred.IsSystemAdmin() { + if jsonutils.QueryBoolean(query, "admin", false) && IsAdminAllowList(userCred, manager) { isSystem := jsonutils.QueryBoolean(query, "system", false) if !isSystem { if len(slaveQueryId) == 0 { diff --git a/pkg/cloudcommon/db/virtualresource.go b/pkg/cloudcommon/db/virtualresource.go index f3ff22967e..3cb4a43236 100644 --- a/pkg/cloudcommon/db/virtualresource.go +++ b/pkg/cloudcommon/db/virtualresource.go @@ -37,12 +37,12 @@ type SVirtualResourceBase struct { } func (model *SVirtualResourceBase) IsOwner(userCred mcclient.TokenCredential) bool { - return userCred.IsSystemAdmin() || userCred.GetProjectId() == model.ProjectId + return userCred.GetProjectId() == model.ProjectId } -func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool { +/*func (model *SVirtualResourceBase) IsAdmin(userCred mcclient.TokenCredential) bool { return userCred.IsSystemAdmin() || (userCred.GetProjectId() == model.ProjectId && userCred.IsAdmin()) -} +}*/ func (model *SVirtualResourceBase) GetOwnerProjectId() string { return model.ProjectId @@ -110,7 +110,7 @@ func (manager *SVirtualResourceBaseManager) ListItemFilter(ctx context.Context, func (manager *SVirtualResourceBaseManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { isSystem, err := data.Bool("is_system") - if err == nil && isSystem && !userCred.IsSystemAdmin() { + if err == nil && isSystem && !IsAdminAllowCreate(userCred, manager) { return nil, httperrors.NewNotSufficientPrivilegeError("non-admin user not allowed to create system object") } return manager.SStandaloneResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) @@ -129,14 +129,14 @@ func (model *SVirtualResourceBase) CustomizeCreate(ctx context.Context, userCred func (manager *SVirtualResourceBaseManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { isAdmin, err := query.Bool("admin") - if err == nil && isAdmin && !userCred.IsSystemAdmin() { + if err == nil && isAdmin && !IsAdminAllowList(userCred, manager) { return false } return true } func (model *SVirtualResourceBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || IsAdminAllowGet(userCred, model) } func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -144,19 +144,19 @@ func (manager *SVirtualResourceBaseManager) AllowCreateItem(ctx context.Context, } func (model *SVirtualResourceBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || IsAdminAllowUpdate(userCred, model) } func (model *SVirtualResourceBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || IsAdminAllowDelete(userCred, model) } func (model *SVirtualResourceBase) AllowGetDetailsMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || IsAdminAllowGetSpec(userCred, model, "metadata") } func (model *SVirtualResourceBase) AllowPerformMetadata(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) + return model.IsOwner(userCred) || IsAdminAllowPerform(userCred, model, "metadata") } func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant, error) { @@ -165,7 +165,7 @@ func (model *SVirtualResourceBase) GetTenantCache(ctx context.Context) (*STenant } func (model *SVirtualResourceBase) getMoreDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, extra *jsonutils.JSONDict) *jsonutils.JSONDict { - if userCred.IsSystemAdmin() { + if IsAdminAllowGet(userCred, model) { // log.Debugf("GetCustomizeColumns") tobj, err := model.GetTenantCache(ctx) if err == nil { @@ -197,7 +197,7 @@ func (model *SVirtualResourceBase) GetExtraDetails(ctx context.Context, userCred } func (model *SVirtualResourceBase) AllowPerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return IsAdminAllowPerform(userCred, model, "change-owner") } func (model *SVirtualResourceBase) PerformChangeOwner(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/cloudcommon/options.go b/pkg/cloudcommon/options.go index fa7730c4a9..c3d92e4201 100644 --- a/pkg/cloudcommon/options.go +++ b/pkg/cloudcommon/options.go @@ -63,6 +63,10 @@ func (this *DBOptions) GetDBConnection() (dialect, connstr string, err error) { } func ParseOptions(optStruct interface{}, optionsRef *Options, args []string, configFileName string) { + if len(consts.GetServiceType()) == 0 { + log.Fatalf("ServiceType not initialized!") + } + serviceName := path.Base(args[0]) parser, err := structarg.NewArgumentParser(optStruct, serviceName, diff --git a/pkg/cloudcommon/policy/policy.go b/pkg/cloudcommon/policy/policy.go index d4ab475993..019f2c4284 100644 --- a/pkg/cloudcommon/policy/policy.go +++ b/pkg/cloudcommon/policy/policy.go @@ -48,6 +48,30 @@ var ( Action: PolicyActionGet, Result: rbacutils.UserAllow, }, + { + Service: "compute", + Resource: "storages", + Action: PolicyActionList, + Result: rbacutils.UserAllow, + }, + { + Service: "compute", + Resource: "storages", + Action: PolicyActionGet, + Result: rbacutils.UserAllow, + }, + { + Service: "compute", + Resource: "schedtags", + Action: PolicyActionList, + Result: rbacutils.UserAllow, + }, + { + Service: "compute", + Resource: "schedtags", + Action: PolicyActionGet, + Result: rbacutils.UserAllow, + }, { Service: "compute", Resource: "cloudregions", @@ -90,6 +114,12 @@ var ( Action: PolicyActionCreate, Result: rbacutils.UserAllow, }, + { + Service: "yunionconf", + Resource: "parameters", + Action: PolicyActionGet, + Result: rbacutils.OwnerAllow, + }, } ) @@ -278,7 +308,7 @@ func (manager *SPolicyManager) explainPolicy(userCred mcclient.TokenCredential, if !consts.IsRbacEnabled() { if !isAdmin { return reqStrs, rbacutils.OwnerAllow, nil - } else if isAdmin && userCred.IsSystemAdmin() { + } else if isAdmin && userCred.HasSystemAdminPrivelege() { return reqStrs, rbacutils.AdminAllow, nil } else { return reqStrs, rbacutils.Deny, httperrors.NewForbiddenError("operation not allowed") @@ -305,7 +335,7 @@ func (manager *SPolicyManager) ExplainRpc(userCred mcclient.TokenCredential, par } func (manager *SPolicyManager) IsAdminCapable(userCred mcclient.TokenCredential) bool { - if !consts.IsRbacEnabled() && userCred.IsSystemAdmin() { + if !consts.IsRbacEnabled() && userCred.HasSystemAdminPrivelege() { return true } diff --git a/pkg/cloudcommon/policy/token.go b/pkg/cloudcommon/policy/token.go new file mode 100644 index 0000000000..c42b846bf4 --- /dev/null +++ b/pkg/cloudcommon/policy/token.go @@ -0,0 +1,145 @@ +package policy + +import ( + "time" + + "yunion.io/x/jsonutils" + "yunion.io/x/pkg/gotypes" + + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/onecloud/pkg/util/rbacutils" +) + +type SPolicyTokenCredential struct { + Token mcclient.TokenCredential +} + +func (self *SPolicyTokenCredential) String() string { + return self.Token.String() +} + +func (self *SPolicyTokenCredential) IsZero() bool { + return self.Token.IsZero() +} + +func (self *SPolicyTokenCredential) GetProjectId() string { + return self.Token.GetProjectId() +} + +func (self *SPolicyTokenCredential) GetTenantId() string { + return self.Token.GetTenantId() +} + +func (self *SPolicyTokenCredential) GetUserId() string { + return self.Token.GetUserId() +} + +func (self *SPolicyTokenCredential) GetServiceURL(service, region, zone, endpointType string) (string, error) { + return self.Token.GetServiceURL(service, region, zone, endpointType) +} + +func (self *SPolicyTokenCredential) GetServiceURLs(service, region, zone, endpointType string) ([]string, error) { + return self.Token.GetServiceURLs(service, region, zone, endpointType) +} + +func (self *SPolicyTokenCredential) GetTokenString() string { + return self.Token.GetTokenString() +} + +func (self *SPolicyTokenCredential) GetDomainId() string { + return self.Token.GetDomainId() +} + +func (self *SPolicyTokenCredential) GetDomainName() string { + return self.Token.GetDomainName() +} + +func (self *SPolicyTokenCredential) GetTenantName() string { + return self.Token.GetTenantName() +} + +func (self *SPolicyTokenCredential) GetProjectName() string { + return self.Token.GetProjectName() +} + +func (self *SPolicyTokenCredential) GetUserName() string { + return self.Token.GetUserName() +} + +func (self *SPolicyTokenCredential) GetRoles() []string { + return self.Token.GetRoles() +} + +func (self *SPolicyTokenCredential) GetExpires() time.Time { + return self.Token.GetExpires() +} + +func (self *SPolicyTokenCredential) IsValid() bool { + return self.Token.IsValid() +} + +func (self *SPolicyTokenCredential) ValidDuration() time.Duration { + return self.Token.ValidDuration() +} + +func (self *SPolicyTokenCredential) GetRegions() []string { + return self.Token.GetRegions() +} + +func (self *SPolicyTokenCredential) GetServiceCatalog() mcclient.IServiceCatalog { + return self.Token.GetServiceCatalog() +} + +func (self *SPolicyTokenCredential) GetCatalogData(serviceTypes []string, region string) jsonutils.JSONObject { + return self.Token.GetCatalogData(serviceTypes, region) +} + +func (self *SPolicyTokenCredential) GetInternalServices(region string) []string { + return self.Token.GetInternalServices(region) +} + +func (self *SPolicyTokenCredential) GetExternalServices(region string) []mcclient.ExternalService { + return self.Token.GetExternalServices(region) +} + +func (self *SPolicyTokenCredential) GetEndpoints(region string, endpointType string) []mcclient.Endpoint { + return self.Token.GetEndpoints(region, endpointType) +} + +func (self *SPolicyTokenCredential) ToJson() jsonutils.JSONObject { + return self.Token.ToJson() +} + +func (self *SPolicyTokenCredential) HasSystemAdminPrivelege() bool { + if consts.IsRbacEnabled() { + return PolicyManager.IsAdminCapable(self.Token) + } + return self.Token.HasSystemAdminPrivelege() +} + +func (self *SPolicyTokenCredential) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + if consts.IsRbacEnabled() { + result := PolicyManager.Allow(true, self.Token, service, resource, action, extra...) + return result == rbacutils.AdminAllow + } + return self.Token.IsAdminAllow(service, resource, action, extra...) +} + +func init() { + gotypes.RegisterSerializable(mcclient.TokenCredentialType, func() gotypes.ISerializable { + return &SPolicyTokenCredential{} + }) +} + +func FilterPolicyCredential(token mcclient.TokenCredential) mcclient.TokenCredential { + if !consts.IsRbacEnabled() { + return token + } + switch token.(type) { + case *SPolicyTokenCredential: + return token + default: + return &SPolicyTokenCredential{Token: token} + } +} diff --git a/pkg/compute/capabilities/handler.go b/pkg/compute/capabilities/handler.go index a6f0aa9378..8df5482467 100644 --- a/pkg/compute/capabilities/handler.go +++ b/pkg/compute/capabilities/handler.go @@ -8,6 +8,7 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -18,7 +19,7 @@ func AddCapabilityHandler(prefix string, app *appsrv.Application) { } func capaHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) query, err := jsonutils.ParseQueryString(r.URL.RawQuery) if err != nil { httperrors.GeneralServerError(w, err) diff --git a/pkg/compute/guestdrivers/azure.go b/pkg/compute/guestdrivers/azure.go index 7c218f9753..ea5c27c059 100644 --- a/pkg/compute/guestdrivers/azure.go +++ b/pkg/compute/guestdrivers/azure.go @@ -16,6 +16,7 @@ import ( "yunion.io/x/pkg/utils" "yunion.io/x/jsonutils" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" "yunion.io/x/onecloud/pkg/compute/models" ) @@ -264,6 +265,10 @@ func (self *SAzureGuestDriver) RequestSyncConfigOnHost(ctx context.Context, gues if err != nil { return nil, err } + + lockman.LockRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcID)) + defer lockman.ReleaseRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcID)) + secgroupCache := models.SecurityGroupCacheManager.Register(ctx, task.GetUserCred(), guest.SecgrpId, vpcID, host.GetRegion().Id, host.ManagerId) if secgroupCache == nil { return nil, fmt.Errorf("failed to registor secgroupCache for secgroup: %s vpc: %s", guest.SecgrpId, vpcID) diff --git a/pkg/compute/guestdrivers/managedvirtual.go b/pkg/compute/guestdrivers/managedvirtual.go index 24bd8f127f..902539b257 100644 --- a/pkg/compute/guestdrivers/managedvirtual.go +++ b/pkg/compute/guestdrivers/managedvirtual.go @@ -11,6 +11,7 @@ import ( "yunion.io/x/pkg/util/secrules" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/models" @@ -448,6 +449,10 @@ func (self *SManagedVirtualizedGuestDriver) RequestSyncConfigOnHost(ctx context. if err != nil { return nil, err } + + lockman.LockRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcId)) + defer lockman.ReleaseRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-%s", guest.SecgrpId, vpcId)) + secgroupCache := models.SecurityGroupCacheManager.Register(ctx, task.GetUserCred(), guest.SecgrpId, vpcId, host.GetRegion().Id, host.ManagerId) if secgroupCache == nil { return nil, fmt.Errorf("failed to registor secgroupCache for secgroup: %s vpc: %s", guest.SecgrpId, vpcId) diff --git a/pkg/compute/guestdrivers/qcloud.go b/pkg/compute/guestdrivers/qcloud.go index cebffa5dfc..b03431c709 100644 --- a/pkg/compute/guestdrivers/qcloud.go +++ b/pkg/compute/guestdrivers/qcloud.go @@ -9,8 +9,10 @@ import ( "yunion.io/x/log" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" + "yunion.io/x/pkg/util/compare" "yunion.io/x/pkg/utils" + "yunion.io/x/onecloud/pkg/cloudcommon/db/lockman" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" "yunion.io/x/onecloud/pkg/cloudprovider" "yunion.io/x/onecloud/pkg/compute/models" @@ -289,6 +291,72 @@ func (self *SQcloudGuestDriver) RequestDeployGuestOnHost(ctx context.Context, gu return nil } +func (self *SQcloudGuestDriver) RequestSyncConfigOnHost(ctx context.Context, guest *models.SGuest, host *models.SHost, task taskman.ITask) error { + taskman.LocalTaskRun(task, func() (jsonutils.JSONObject, error) { + ihost, err := host.GetIHost() + if err != nil { + return nil, err + } + iVM, err := ihost.GetIVMById(guest.ExternalId) + if err != nil { + return nil, err + } + + if fwOnly, _ := task.GetParams().Bool("fw_only"); fwOnly { + iregion, err := host.GetIRegion() + if err != nil { + return nil, err + } + lockman.LockRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-normal", guest.SecgrpId)) + defer lockman.ReleaseRawObject(ctx, "secgroupcache", fmt.Sprintf("%s-normal", guest.SecgrpId)) + + secgroupCache := models.SecurityGroupCacheManager.Register(ctx, task.GetUserCred(), guest.SecgrpId, "normal", host.GetRegion().Id, host.ManagerId) + if secgroupCache == nil { + return nil, fmt.Errorf("failed to registor secgroupCache for secgroup: %s", guest.SecgrpId) + } + extID, err := iregion.SyncSecurityGroup(secgroupCache.ExternalId, "normal", guest.GetSecgroupName(), "", guest.GetSecRules()) + if err != nil { + return nil, err + } + if err = secgroupCache.SetExternalId(extID); err != nil { + return nil, err + } + return nil, iVM.AssignSecurityGroup(extID) + } + + iDisks, err := iVM.GetIDisks() + if err != nil { + return nil, err + } + disks := make([]models.SDisk, 0) + for _, guestdisk := range guest.GetDisks() { + disk := guestdisk.GetDisk() + disks = append(disks, *disk) + } + + added := make([]models.SDisk, 0) + commondb := make([]models.SDisk, 0) + commonext := make([]cloudprovider.ICloudDisk, 0) + removed := make([]cloudprovider.ICloudDisk, 0) + + if err := compare.CompareSets(disks, iDisks, &added, &commondb, &commonext, &removed); err != nil { + return nil, err + } + for _, disk := range removed { + if err := iVM.DetachDisk(ctx, disk.GetId()); err != nil { + return nil, err + } + } + for _, disk := range added { + if err := iVM.AttachDisk(ctx, disk.ExternalId); err != nil { + return nil, err + } + } + return nil, nil + }) + return nil +} + func (self *SQcloudGuestDriver) AllowReconfigGuest() bool { return true } diff --git a/pkg/compute/misc/handler.go b/pkg/compute/misc/handler.go index 21e6de19ad..5c9ea1cd98 100644 --- a/pkg/compute/misc/handler.go +++ b/pkg/compute/misc/handler.go @@ -7,6 +7,7 @@ import ( "yunion.io/x/log" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/compute/options" "yunion.io/x/onecloud/pkg/httperrors" @@ -58,7 +59,7 @@ func getBmPrepareScript(ctx context.Context, w http.ResponseWriter, r *http.Requ httperrors.InternalServerError(w, err.Error()) return } - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) var script string script += fmt.Sprintf("curl -fsSL -k -o ./baremetal_prepare.tar.gz %s;", options.Options.BaremetalPreparePackageUrl) diff --git a/pkg/compute/models/baremetalagents.go b/pkg/compute/models/baremetalagents.go index 780a5645ec..5a0bd97232 100644 --- a/pkg/compute/models/baremetalagents.go +++ b/pkg/compute/models/baremetalagents.go @@ -19,12 +19,10 @@ const ( type SBaremetalagentManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } type SBaremetalagent struct { db.SStandaloneResourceBase - SInfrastructure Status string `width:"36" charset:"ascii" nullable:"false" default:"disable" list:"user" create:"optional"` AccessIp string `width:"16" charset:"ascii" nullable:"false" list:"admin" update:"admin" create:"admin_required"` @@ -38,6 +36,26 @@ func init() { BaremetalagentManager = &SBaremetalagentManager{SStandaloneResourceBaseManager: db.NewStandaloneResourceBaseManager(SBaremetalagent{}, "baremetalagents_tbl", "baremetalagent", "baremetalagents")} } +func (self *SBaremetalagentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SBaremetalagentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SBaremetalagent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SBaremetalagent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SBaremetalagent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (self *SBaremetalagent) ValidateDeleteCondition(ctx context.Context) error { if self.Status == BAREMETAL_AGENT_ENABLED { return fmt.Errorf("Cannot delete in status %s", self.Status) @@ -80,7 +98,7 @@ func (manager *SBaremetalagentManager) ValidateCreateData(ctx context.Context, u } func (self *SBaremetalagent) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "enable") } func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -95,7 +113,7 @@ func (self *SBaremetalagent) PerformEnable(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "disable") } func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -110,7 +128,7 @@ func (self *SBaremetalagent) PerformDisable(ctx context.Context, userCred mcclie } func (self *SBaremetalagent) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "online") } func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -125,7 +143,7 @@ func (self *SBaremetalagent) PerformOnline(ctx context.Context, userCred mcclien } func (self *SBaremetalagent) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "offline") } func (self *SBaremetalagent) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cachedimages.go b/pkg/compute/models/cachedimages.go index 4093d90ba2..302c8f7814 100644 --- a/pkg/compute/models/cachedimages.go +++ b/pkg/compute/models/cachedimages.go @@ -28,7 +28,6 @@ const ( type SCachedimageManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var CachedimageManager *SCachedimageManager @@ -46,7 +45,6 @@ func init() { type SCachedimage struct { db.SStandaloneResourceBase - SInfrastructure Size int64 `nullable:"false" list:"admin" update:"admin" create:"admin_required"` // = Column(BigInteger, nullable=False) # in Byte // virtual_size = Column(BigInteger, nullable=False) # in Byte @@ -56,6 +54,26 @@ type SCachedimage struct { RefCount int `default:"0" list:"admin"` // = Column(Integer, default=0, server_default='0') } +func (self *SCachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SCachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SCachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SCachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SCachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (self *SCachedimage) ValidateDeleteCondition(ctx context.Context) error { if self.getStoragecacheCount() > 0 { return httperrors.NewNotEmptyError("The image has been cached on storages") @@ -240,7 +258,7 @@ func (self *SCachedimage) GetCustomizeColumns(ctx context.Context, userCred mccl } func (self *SCachedimage) AllowPerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "refresh") } func (self *SCachedimage) PerformRefresh(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudaccounts.go b/pkg/compute/models/cloudaccounts.go index 280e89d50c..5d042f5f5e 100644 --- a/pkg/compute/models/cloudaccounts.go +++ b/pkg/compute/models/cloudaccounts.go @@ -25,7 +25,6 @@ import ( type SCloudaccountManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var CloudaccountManager *SCloudaccountManager @@ -43,7 +42,6 @@ func init() { type SCloudaccount struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure AccessUrl string `width:"64" charset:"ascii" nullable:"true" list:"admin" update:"admin" create:"admin_optional"` @@ -60,6 +58,26 @@ type SCloudaccount struct { Provider string `width:"64" charset:"ascii" list:"admin" create:"admin_required"` } +func (self *SCloudaccountManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SCloudaccountManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SCloudaccount) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SCloudaccount) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SCloudaccount) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (self *SCloudaccount) GetCloudproviders() []SCloudprovider { cloudproviders := []SCloudprovider{} q := CloudproviderManager.Query().Equals("cloudaccount_id", self.Id) @@ -202,7 +220,7 @@ func (self *SCloudaccount) CanSync() bool { } func (self *SCloudaccount) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -221,7 +239,7 @@ func (self *SCloudaccount) PerformSync(ctx context.Context, userCred mcclient.To } func (self *SCloudaccount) AllowPerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "update-credential") } func (self *SCloudaccount) PerformUpdateCredential(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -447,7 +465,7 @@ func (self *SCloudaccount) ImportSubAccount(ctx context.Context, userCred mcclie } func (self *SCloudaccount) AllowPerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "import") } func (self *SCloudaccount) PerformImport(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -623,7 +641,7 @@ func (self *SCloudaccount) GetBalance() (float64, error) { } func (self *SCloudaccount) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowGetSpec(userCred, self, "balance") } func (self *SCloudaccount) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudproviders.go b/pkg/compute/models/cloudproviders.go index cbf25ac56c..83a4f6f2ec 100644 --- a/pkg/compute/models/cloudproviders.go +++ b/pkg/compute/models/cloudproviders.go @@ -38,7 +38,6 @@ const ( type SCloudproviderManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var CloudproviderManager *SCloudproviderManager @@ -56,7 +55,6 @@ func init() { type SCloudprovider struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure AccessUrl string `width:"64" charset:"ascii" nullable:"true" list:"admin" update:"admin" create:"admin_optional"` // Hostname string `width:"64" charset:"ascii" nullable:"true"` // Column(VARCHAR(64, charset='ascii'), nullable=False) @@ -85,6 +83,26 @@ func (self *SCloudprovider) GetOwnerProjectId() string { return self.ProjectId } +func (self *SCloudproviderManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SCloudproviderManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SCloudprovider) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SCloudprovider) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SCloudprovider) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (self *SCloudprovider) ValidateDeleteCondition(ctx context.Context) error { if self.Enabled { return httperrors.NewInvalidStatusError("provider is enabled") @@ -309,7 +327,7 @@ func (sr *SSyncRange) Normalize() error { } func (self *SCloudprovider) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SCloudprovider) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -342,7 +360,7 @@ func (self *SCloudprovider) StartSyncCloudProviderInfoTask(ctx context.Context, } func (self *SCloudprovider) AllowPerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "change-project") } func (self *SCloudprovider) PerformChangeProject(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -594,7 +612,7 @@ func (self *SCloudprovider) GetBalance() (float64, error) { } func (self *SCloudprovider) AllowGetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowGetSpec(userCred, self, "balance") } func (self *SCloudprovider) GetDetailsBalance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/cloudregions.go b/pkg/compute/models/cloudregions.go index 0e1a3608b4..8d3c327fc7 100644 --- a/pkg/compute/models/cloudregions.go +++ b/pkg/compute/models/cloudregions.go @@ -25,7 +25,6 @@ const ( type SCloudregionManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var CloudregionManager *SCloudregionManager @@ -43,7 +42,6 @@ func init() { type SCloudregion struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure Latitude float32 `list:"user"` Longitude float32 `list:"user"` @@ -54,6 +52,22 @@ func (manager *SCloudregionManager) AllowListItems(ctx context.Context, userCred return true } +func (self *SCloudregionManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SCloudregion) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SCloudregion) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SCloudregion) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (self *SCloudregion) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { idstr, _ := data.GetString("id") if len(idstr) > 0 { @@ -250,7 +264,7 @@ func (manager *SCloudregionManager) newFromCloudRegion(cloudRegion cloudprovider } func (self *SCloudregion) AllowPerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "default-vpc") } func (self *SCloudregion) PerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/disks.go b/pkg/compute/models/disks.go index 8011d8beb6..3f62117d96 100644 --- a/pkg/compute/models/disks.go +++ b/pkg/compute/models/disks.go @@ -445,7 +445,7 @@ func (self *SDisk) StartAllocate(ctx context.Context, host *SHost, storage *SSto } func (self *SDisk) AllowGetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "convert-snapshot") } func (self *SDisk) GetDetailsConvertSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -502,7 +502,7 @@ func (self *SDisk) CleanUpDiskSnapshots(ctx context.Context, userCred mcclient.T } func (self *SDisk) AllowPerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "create-snapshot") } func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -516,7 +516,7 @@ func (self *SDisk) PerformCreateSnapshot(ctx context.Context, userCred mcclient. } func (self *SDisk) AllowPerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "disk-reset") } func (self *SDisk) PerformDiskReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -563,7 +563,7 @@ func (self *SDisk) StartResetDisk(ctx context.Context, userCred mcclient.TokenCr } func (self *SDisk) AllowPerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "resize") } func (self *SDisk) PerformResize(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -656,7 +656,7 @@ func (self *SDisk) PrepareSaveImage(ctx context.Context, userCred mcclient.Token } func (self *SDisk) AllowPerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "save") } func (self *SDisk) PerformSave(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1151,7 +1151,7 @@ func (self *SDisk) RealDelete(ctx context.Context, userCred mcclient.TokenCreden } func (self *SDisk) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SDisk) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1339,7 +1339,7 @@ func (self *SDisk) isInit() bool { } func (self *SDisk) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "cancel-delete") } func (self *SDisk) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dnsrecords.go b/pkg/compute/models/dnsrecords.go index 14c5ec9f2f..a5843c5a69 100644 --- a/pkg/compute/models/dnsrecords.go +++ b/pkg/compute/models/dnsrecords.go @@ -383,7 +383,7 @@ func (rec *SDnsRecord) AddInfo(userCred mcclient.TokenCredential, data jsonutils } func (rec *SDnsRecord) AllowPerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "add-records") } func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -402,7 +402,7 @@ func (rec *SDnsRecord) PerformAddRecords(ctx context.Context, userCred mcclient. } func (rec *SDnsRecord) AllowPerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "remove-records") } func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -411,7 +411,7 @@ func (rec *SDnsRecord) PerformRemoveRecords(ctx context.Context, userCred mcclie } func (rec *SDnsRecord) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsSystemAdmin() + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "enable") } func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -429,7 +429,7 @@ func (rec *SDnsRecord) PerformEnable(ctx context.Context, userCred mcclient.Toke } func (rec *SDnsRecord) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return rec.IsOwner(userCred) || userCred.IsSystemAdmin() + return rec.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rec, "disable") } func (rec *SDnsRecord) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/dynamicschedtags.go b/pkg/compute/models/dynamicschedtags.go index 3911948365..54443b2f18 100644 --- a/pkg/compute/models/dynamicschedtags.go +++ b/pkg/compute/models/dynamicschedtags.go @@ -15,7 +15,6 @@ import ( type SDynamicschedtagManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var DynamicschedtagManager *SDynamicschedtagManager @@ -37,7 +36,6 @@ func init() { // type SDynamicschedtag struct { db.SStandaloneResourceBase - SInfrastructure Condition string `width:"256" charset:"ascii" nullable:"false" list:"user" create:"required" update:"admin"` SchedtagId string `width:"36" charset:"ascii" nullable:"false" list:"user" create:"required" update:"admin"` @@ -45,6 +43,26 @@ type SDynamicschedtag struct { Enabled bool `nullable:"false" default:"true" create:"optional" list:"user" update:"user"` } +func (self *SDynamicschedtagManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SDynamicschedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SDynamicschedtag) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SDynamicschedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SDynamicschedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func validateDynamicSchedtagInputData(data *jsonutils.JSONDict, create bool) error { condStr := jsonutils.GetAnyString(data, []string{"condition"}) if len(condStr) == 0 && create { @@ -132,7 +150,7 @@ func (manager *SDynamicschedtagManager) getAllEnabledDynamicSchedtags() []SDynam } func (self *SDynamicschedtag) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "evaluate") } func (self *SDynamicschedtag) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/elasticips.go b/pkg/compute/models/elasticips.go index b879e2010e..861c5849a9 100644 --- a/pkg/compute/models/elasticips.go +++ b/pkg/compute/models/elasticips.go @@ -493,7 +493,7 @@ func (self *SElasticip) StartEipDeallocateTask(ctx context.Context, userCred mcc } func (self *SElasticip) AllowPerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "associate") } func (self *SElasticip) PerformAssociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -593,7 +593,7 @@ func (self *SElasticip) StartEipAssociateTask(ctx context.Context, userCred mccl } func (self *SElasticip) AllowPerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "dissociate") } func (self *SElasticip) PerformDissociate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -647,7 +647,7 @@ func (self *SElasticip) GetIEip() (cloudprovider.ICloudEIP, error) { } func (self *SElasticip) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sync") } func (self *SElasticip) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -731,7 +731,7 @@ func (manager *SElasticipManager) allocateEipAndAssociateVM(ctx context.Context, } func (self *SElasticip) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-bandwidth") } func (self *SElasticip) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -834,7 +834,7 @@ func (manager *SElasticipManager) TotalCount(projectId string, rangeObj db.IStan } func (self *SElasticip) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SElasticip) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/guest_actions.go b/pkg/compute/models/guest_actions.go index 79fb5d5124..13c6309056 100644 --- a/pkg/compute/models/guest_actions.go +++ b/pkg/compute/models/guest_actions.go @@ -30,7 +30,7 @@ import ( ) func (self *SGuest) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "vnc") } func (self *SGuest) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -54,7 +54,7 @@ func (self *SGuest) AllowPerformMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "monitor") } func (self *SGuest) PerformMonitor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -70,7 +70,7 @@ func (self *SGuest) PerformMonitor(ctx context.Context, userCred mcclient.TokenC } func (self *SGuest) AllowGetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "desc") } func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -82,402 +82,414 @@ func (self *SGuest) GetDetailsDesc(ctx context.Context, userCred mcclient.TokenC return desc, nil } -func (self *SGuest) StartInsertIsoTask(ctx context.Context, imageId string, hostId string, userCred mcclient.TokenCredential, parentTaskId string) error { - self.insertIso(imageId) - - data := jsonutils.NewDict() - data.Add(jsonutils.NewString(imageId), "image_id") - data.Add(jsonutils.NewString(hostId), "host_id") - - task, err := taskman.TaskManager.NewTask(ctx, "GuestInsertIsoTask", self, userCred, data, parentTaskId, "", nil) - if err != nil { - return err - } - task.ScheduleRun(nil) - return nil +func (self *SGuest) AllowPerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "save-image") } -func (self *SGuest) StartGueststartTask(ctx context.Context, userCred mcclient.TokenCredential, data *jsonutils.JSONDict, parentTaskId string) error { - self.SetStatus(userCred, VM_START_START, "") - task, err := taskman.TaskManager.NewTask(ctx, "GuestStartTask", self, userCred, data, parentTaskId, "", nil) - if err != nil { - return err - } - task.ScheduleRun(nil) - return nil -} - -func (self *SGuest) StartGuestCreateTask(ctx context.Context, userCred mcclient.TokenCredential, params *jsonutils.JSONDict, pendingUsage quotas.IQuota, parentTaskId string) error { - return self.GetDriver().StartGuestCreateTask(self, ctx, userCred, params, pendingUsage, parentTaskId) -} - -func (self *SGuest) AllowPerformReset(ctx context.Context, - userCred mcclient.TokenCredential, - query jsonutils.JSONObject, - data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, - data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - isHard := jsonutils.QueryBoolean(data, "is_hard", false) - if self.Status == VM_RUNNING || self.Status == VM_STOP_FAILED { - self.GetDriver().StartGuestResetTask(self, ctx, userCred, isHard, "") - return nil, nil - } - return nil, httperrors.NewInvalidStatusError("Cannot reset VM in status %s", self.Status) -} - -func (self *SGuest) AllowPerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - if !utils.IsInStringArray(self.Status, []string{VM_RUNNING, VM_READY}) { - return nil, httperrors.NewInvalidStatusError("Cannot do snapshot when VM in status %s", self.Status) - } - diskId, err := data.GetString("disk_id") - if err != nil { - return nil, httperrors.NewBadRequestError(err.Error()) - } - name, err := data.GetString("name") - if err != nil { - return nil, httperrors.NewBadRequestError(err.Error()) - } - err = ValidateSnapshotName(self.Hypervisor, name, userCred.GetProjectId()) - if err != nil { - return nil, httperrors.NewBadRequestError(err.Error()) - } - if self.GetGuestDisk(diskId) == nil { - return nil, httperrors.NewNotFoundError("Guest disk %s not found", diskId) - } - if self.GetHypervisor() == HYPERVISOR_KVM { - q := SnapshotManager.Query() - cnt := q.Filter(sqlchemy.AND(sqlchemy.Equals(q.Field("disk_id"), diskId), - sqlchemy.Equals(q.Field("created_by"), MANUAL), - sqlchemy.Equals(q.Field("fake_deleted"), false))).Count() - if cnt >= options.Options.DefaultMaxManualSnapshotCount { - return nil, httperrors.NewBadRequestError("Disk %s snapshot full, cannot take any more", diskId) +func (self *SGuest) PerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + if !utils.IsInStringArray(self.Status, []string{VM_READY}) { + return nil, httperrors.NewInputParameterError("Cannot save image in status %s", self.Status) + } else if !data.Contains("name") { + return nil, httperrors.NewInputParameterError("Image name is required") + } else if disks := self.CategorizeDisks(); disks.Root == nil { + return nil, httperrors.NewInputParameterError("No root image") + } else { + kwargs := data.(*jsonutils.JSONDict) + restart := self.Status == VM_RUNNING + properties := jsonutils.NewDict() + if notes, err := data.GetString("notes"); err != nil && len(notes) > 0 { + properties.Add(jsonutils.NewString(notes), "notes") } - pendingUsage := &SQuota{Snapshot: 1} - err = QuotaManager.CheckSetPendingQuota(ctx, userCred, self.ProjectId, pendingUsage) - if err != nil { - return nil, httperrors.NewBadRequestError("Check set pending quota error %s", err) - } - snapshot, err := SnapshotManager.CreateSnapshot(ctx, userCred, MANUAL, diskId, self.Id, "", name) - QuotaManager.CancelPendingUsage(ctx, userCred, self.ProjectId, nil, pendingUsage) - if err != nil { + properties.Add(jsonutils.NewString(self.OsType), "os_type") + kwargs.Add(properties, "properties") + kwargs.Add(jsonutils.NewBool(restart), "restart") + + lockman.LockObject(ctx, disks.Root) + defer lockman.ReleaseObject(ctx, disks.Root) + + if imageId, err := disks.Root.PrepareSaveImage(ctx, userCred, kwargs); err != nil { return nil, err + } else { + kwargs.Add(jsonutils.NewString(imageId), "image_id") } - err = self.StartDiskSnapshot(ctx, userCred, diskId, snapshot.Id) - return nil, err - } else { - snapshot, err := SnapshotManager.CreateSnapshot(ctx, userCred, MANUAL, diskId, self.Id, "", name) - if err != nil { - return nil, err - } - err = self.StartDiskSnapshot(ctx, userCred, diskId, snapshot.Id) + return nil, self.StartGuestSaveImage(ctx, userCred, kwargs, "") + } +} + +func (self *SGuest) StartGuestSaveImage(ctx context.Context, userCred mcclient.TokenCredential, data *jsonutils.JSONDict, parentTaskId string) error { + return self.GetDriver().StartGuestSaveImage(ctx, userCred, self, data, parentTaskId) +} + +func (self *SGuest) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sync") + +} + +func (self *SGuest) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + if err := self.StartSyncTask(ctx, userCred, false, ""); err != nil { return nil, err } - + return nil, nil } -func (self *SGuest) StartDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, diskId, snapshotId string) error { - self.SetStatus(userCred, VM_START_SNAPSHOT, "StartDiskSnapshot") - params := jsonutils.NewDict() - params.Set("disk_id", jsonutils.NewString(diskId)) - params.Set("snapshot_id", jsonutils.NewString(snapshotId)) - return self.GetDriver().StartGuestDiskSnapshotTask(ctx, userCred, self, params) +func (self *SGuest) GetQemuVersion(userCred mcclient.TokenCredential) string { + return self.GetMetadata("__qemu_version", userCred) } -func (self *SGuest) AllowPerformStop(ctx context.Context, - userCred mcclient.TokenCredential, - query jsonutils.JSONObject, - data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, - data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - // XXX if is force, force stop guest - var isForce = jsonutils.QueryBoolean(data, "is_force", false) - if isForce || utils.IsInStringArray(self.Status, []string{VM_RUNNING, VM_STOP_FAILED}) { - return nil, self.StartGuestStopTask(ctx, userCred, isForce, "") - } else { - return nil, httperrors.NewInvalidStatusError("Cannot stop server in status %s", self.Status) - } -} - -func (self *SGuest) StartGuestStopTask(ctx context.Context, userCred mcclient.TokenCredential, isForce bool, parentTaskId string) error { - if len(parentTaskId) == 0 { - self.SetStatus(userCred, VM_START_STOP, "") - } - params := jsonutils.NewDict() - if isForce { - params.Add(jsonutils.JSONTrue, "is_force") - } - if len(parentTaskId) > 0 { - params.Add(jsonutils.JSONTrue, "subtask") - } - return self.GetDriver().StartGuestStopTask(self, ctx, userCred, params, parentTaskId) -} - -func (self *SGuest) AllowPerformRestart(ctx context.Context, - userCred mcclient.TokenCredential, - query jsonutils.JSONObject, - data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - isForce := jsonutils.QueryBoolean(data, "is_force", false) - if utils.IsInStringArray(self.Status, []string{VM_RUNNING, VM_STOP_FAILED}) || (isForce && self.Status == VM_STOPPING) { - return nil, self.GetDriver().StartGuestRestartTask(self, ctx, userCred, isForce, "") - } else { - return nil, httperrors.NewInvalidStatusError("Cannot do restart server in status %s", self.Status) - } -} - -func (self *SGuest) AllowPerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) PerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - if self.Hypervisor != HYPERVISOR_KVM { - return nil, httperrors.NewUnsupportOperationError("Not allow for hypervisor %s", self.Hypervisor) - } - if self.Status != VM_RUNNING { - return nil, httperrors.NewInvalidStatusError("Cannot send keys in status %s", self.Status) - } - keys, err := data.GetString("keys") - if err != nil { - return nil, err - } - err = self.VerifySendKeys(keys) - if err != nil { - return nil, httperrors.NewBadRequestError(err.Error()) - } - cmd := fmt.Sprintf("sendkey %s", keys) - duration, err := data.Int("duration") - if err == nil { - cmd = fmt.Sprintf("%s %d", cmd, duration) - } - _, err = self.SendMonitorCommand(ctx, userCred, cmd) - return nil, err -} - -func (self *SGuest) VerifySendKeys(keyStr string) error { - keys := strings.Split(keyStr, "-") - for _, key := range keys { - if !self.IsLegalKey(key) { - return fmt.Errorf("Unknown key '%s'", key) - } - } - return nil -} - -func (self *SGuest) IsLegalKey(key string) bool { - singleKeys := "1234567890abcdefghijklmnopqrstuvwxyz" - legalKeys := []string{"ctrl", "ctrl_r", "alt", "alt_r", "shift", "shift_r", - "delete", "esc", "insert", "print", "spc", - "f1", "f2", "f3", "f4", "f5", "f6", - "f7", "f8", "f9", "f10", "f11", "f12", - "home", "pgup", "pgdn", "end", - "up", "down", "left", "right", - "tab", "minus", "equal", "backspace", "backslash", - "bracket_left", "bracket_right", "backslash", - "semicolon", "apostrophe", "grave_accent", "ret", - "comma", "dot", "slash", - "caps_lock", "num_lock", "scroll_lock"} - if len(key) > 1 && !utils.IsInStringArray(key, legalKeys) { +// if qemuVer >= compareVer return true +func (self *SGuest) CheckQemuVersion(qemuVer, compareVer string) bool { + if len(qemuVer) == 0 { return false - } else if len(key) == 1 && !strings.Contains(singleKeys, key) { + } + + compareVersion := strings.Split(compareVer, ".") + guestVersion := strings.Split(qemuVer, ".") + var i = 0 + for ; i < len(guestVersion); i++ { + if i >= len(compareVersion) { + return true + } + v, _ := strconv.ParseInt(guestVersion[i], 10, 0) + compareV, _ := strconv.ParseInt(compareVersion[i], 10, 0) + if v < compareV { + return false + } else if v > compareV { + return true + } + } + if i < len(compareVersion)-1 { return false } return true } -func (self *SGuest) SendMonitorCommand(ctx context.Context, userCred mcclient.TokenCredential, cmd string) (jsonutils.JSONObject, error) { - host := self.GetHost() - url := fmt.Sprintf("%s/servers/%s/monitor", host.ManagerUri, self.Id) - header := http.Header{} - header.Add("X-Auth-Token", userCred.GetTokenString()) - body := jsonutils.NewDict() - body.Add(jsonutils.NewString(cmd), "cmd") - _, res, err := httputils.JSONRequest(httputils.GetDefaultClient(), ctx, "POST", url, header, body, false) - if err != nil { - return nil, err - } - ret := res.(*jsonutils.JSONDict) - return ret, nil +func (self *SGuest) AllowPerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "migrate") } -func (self *SGuest) AllowPerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - if !utils.IsInStringArray(self.Status, []string{VM_READY, VM_RUNNING}) { - return nil, httperrors.NewInvalidStatusError("cannot associate eip in status %s", self.Status) +func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + if self.GetHypervisor() != HYPERVISOR_KVM { + return nil, httperrors.NewNotAcceptableError("Not allow for hypervisor %s", self.GetHypervisor()) } - - eip, err := self.GetEip() - if err != nil { - log.Errorf("Fail to get Eip %s", err) - return nil, httperrors.NewGeneralError(err) + isRescueMode := jsonutils.QueryBoolean(data, "rescue_mode", false) + if !isRescueMode && self.Status != VM_READY { + return nil, httperrors.NewServerStatusError("Cannot normal migrate guest in status %s, try rescue mode or server-live-migrate?", self.Status) } - if eip != nil { - return nil, httperrors.NewInvalidStatusError("already associate with eip") - } - eipStr := jsonutils.GetAnyString(data, []string{"eip", "eip_id"}) - if len(eipStr) == 0 { - return nil, httperrors.NewInputParameterError("missing eip or eip_id") - } - eipObj, err := ElasticipManager.FetchByIdOrName(userCred, eipStr) - if err != nil { - if err == sql.ErrNoRows { - return nil, httperrors.NewResourceNotFoundError("eip %s not found", eipStr) - } else { - return nil, httperrors.NewGeneralError(err) + if isRescueMode { + guestDisks := self.GetDisks() + for _, guestDisk := range guestDisks { + if utils.IsInStringArray( + guestDisk.GetDisk().GetStorage().StorageType, STORAGE_LOCAL_TYPES) { + return nil, httperrors.NewBadRequestError("Rescue mode requires all disk store in shared storages") + } } } - - eip = eipObj.(*SElasticip) - eipRegion := eip.GetRegion() - instRegion := self.getRegion() - - if eip.Mode == EIP_MODE_INSTANCE_PUBLICIP { - return nil, httperrors.NewUnsupportOperationError("fixed eip cannot be associated") + devices := self.GetIsolatedDevices() + if devices != nil && len(devices) > 0 { + return nil, httperrors.NewBadRequestError("Cannot migrate with isolated devices") } - - eipVm := eip.GetAssociateVM() - if eipVm != nil { - return nil, httperrors.NewConflictError("eip has been associated") + var preferHostId string + preferHost, _ := data.GetString("prefer_host") + if len(preferHost) > 0 { + if !db.IsAdminAllowPerform(userCred, self, "assign-host") { + return nil, httperrors.NewBadRequestError("Only system admin can assign host") + } + iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) + if iHost == nil { + return nil, httperrors.NewBadRequestError("Host %s not found", preferHost) + } + host := iHost.(*SHost) + preferHostId = host.Id } - - if eipRegion.Id != instRegion.Id { - return nil, httperrors.NewInputParameterError("cannot associate eip and instance in different region") - } - - host := self.GetHost() - if host == nil { - return nil, httperrors.NewInputParameterError("server host is not found???") - } - - if host.ManagerId != eip.ManagerId { - return nil, httperrors.NewInputParameterError("cannot associate eip and instance in different provider") - } - - self.SetStatus(userCred, VM_ASSOCIATE_EIP, "associate eip") - - params := jsonutils.NewDict() - params.Add(jsonutils.NewString(self.ExternalId), "instance_external_id") - params.Add(jsonutils.NewString(self.Id), "instance_id") - params.Add(jsonutils.NewString(EIP_ASSOCIATE_TYPE_SERVER), "instance_type") - - err = eip.StartEipAssociateTask(ctx, userCred, params) - + err := self.StartMigrateTask(ctx, userCred, isRescueMode, self.Status, preferHostId, "") return nil, err } -func (self *SGuest) AllowPerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SGuest) StartMigrateTask(ctx context.Context, userCred mcclient.TokenCredential, isRescueMode bool, guestStatus, preferHostId, parentTaskId string) error { + data := jsonutils.NewDict() + if isRescueMode { + data.Set("is_rescue_mode", jsonutils.JSONTrue) + } + if len(preferHostId) > 0 { + data.Set("prefer_host_id", jsonutils.NewString(preferHostId)) + } + data.Set("guest_status", jsonutils.NewString(guestStatus)) + if task, err := taskman.TaskManager.NewTask(ctx, "GuestMigrateTask", self, userCred, data, parentTaskId, "", nil); err != nil { + log.Errorf(err.Error()) + return err + } else { + task.ScheduleRun(nil) + } + return nil } -func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - eip, err := self.GetEip() - if err != nil { - log.Errorf("Fail to get Eip %s", err) - return nil, httperrors.NewGeneralError(err) - } - if eip == nil { - return nil, httperrors.NewInvalidStatusError("No eip to dissociate") - } - - self.SetStatus(userCred, VM_DISSOCIATE_EIP, "associate eip") - - err = eip.StartEipDissociateTask(ctx, userCred, "") - if err != nil { - log.Errorf("fail to start dissociate task %s", err) - return nil, httperrors.NewGeneralError(err) - } - return nil, nil +func (self *SGuest) AllowPerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "live-migrate") } -func (self *SGuest) AllowPerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + if self.GetHypervisor() != HYPERVISOR_KVM { + return nil, httperrors.NewNotAcceptableError("Not allow for hypervisor %s", self.GetHypervisor()) + } + imageId := self.GetDisks()[0].GetDisk().TemplateId + image, err := CachedimageManager.GetImageById(ctx, userCred, imageId, false) + if err != nil { + return nil, err + } + if image.DiskFormat != "qcow2" { + return nil, httperrors.NewBadRequestError("Live migrate only support image fromat qocw2") + } + if utils.IsInStringArray(self.Status, []string{VM_RUNNING, VM_SUSPEND}) { + cdrom := self.getCdrom() + if cdrom != nil && len(cdrom.ImageId) > 0 { + return nil, httperrors.NewBadRequestError("Cannot migrate with cdrom") + } + devices := self.GetIsolatedDevices() + if devices != nil && len(devices) > 0 { + return nil, httperrors.NewBadRequestError("Cannot migrate with isolated devices") + } + if !self.CheckQemuVersion(self.GetQemuVersion(userCred), "1.1.2") { + return nil, httperrors.NewBadRequestError("Cannot do live migrate, too low qemu version") + } + var preferHostId string + preferHost, _ := data.GetString("prefer_host") + if len(preferHost) > 0 { + if !db.IsAdminAllowPerform(userCred, self, "assign-host") { + return nil, httperrors.NewBadRequestError("Only system admin can assign host") + } + iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) + if iHost == nil { + return nil, httperrors.NewBadRequestError("Host %s not found", preferHost) + } + host := iHost.(*SHost) + preferHostId = host.Id + } + err := self.StartGuestLiveMigrateTask(ctx, userCred, self.Status, preferHostId, "") + return nil, err + } + return nil, httperrors.NewBadRequestError("Cannot live migrate in status %s", self.Status) } -func (self *SGuest) PerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - bw, err := data.Int("bandwidth") - if err != nil { - return nil, httperrors.NewInputParameterError("Missing bandwidth") +func (self *SGuest) StartGuestLiveMigrateTask(ctx context.Context, userCred mcclient.TokenCredential, guestStatus, preferHostId, parentTaskId string) error { + self.SetStatus(userCred, VM_START_MIGRATE, "") + data := jsonutils.NewDict() + if len(preferHostId) > 0 { + data.Set("prefer_host_id", jsonutils.NewString(preferHostId)) } - - chargeType, _ := data.GetString("charge_type") - if len(chargeType) == 0 { - chargeType = EIP_CHARGE_TYPE_DEFAULT + data.Set("guest_status", jsonutils.NewString(guestStatus)) + if task, err := taskman.TaskManager.NewTask(ctx, "GuestLiveMigrateTask", self, userCred, data, parentTaskId, "", nil); err != nil { + log.Errorf(err.Error()) + return err + } else { + task.ScheduleRun(nil) } - - if len(self.ExternalId) == 0 { - return nil, httperrors.NewInvalidStatusError("Not a managed VM") - } - host := self.GetHost() - if host == nil { - return nil, httperrors.NewInvalidStatusError("No host???") - } - - _, err = host.GetDriver() - if err != nil { - return nil, httperrors.NewInvalidStatusError("No valid cloud provider") - } - - region := host.GetRegion() - if region == nil { - return nil, httperrors.NewInvalidStatusError("No cloudregion???") - } - - err = ElasticipManager.allocateEipAndAssociateVM(ctx, userCred, self, int(bw), chargeType, host.ManagerId, region.Id) - if err != nil { - return nil, httperrors.NewGeneralError(err) - } - - self.SetStatus(userCred, VM_ASSOCIATE_EIP, "allocate and associate EIP") - - return nil, nil + return nil } -func (self *SGuest) AllowPerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SGuest) AllowPerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "deploy") } -func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - userData, err := data.GetString("user_data") - if err != nil { - return nil, httperrors.NewInputParameterError("missing user_data %s", err) +func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + kwargs, ok := data.(*jsonutils.JSONDict) + if !ok { + return nil, fmt.Errorf("Parse query body error") } - err = self.setUserData(ctx, userCred, userData) - if err != nil { - return nil, httperrors.NewGeneralError(err) - } - if len(self.HostId) > 0 { - err = self.StartSyncTask(ctx, userCred, false, "") - if err != nil { - return nil, httperrors.NewGeneralError(err) + + // 变更密码/密钥时需要Restart才能生效。更新普通字段不需要Restart + doRestart := false + if kwargs.Contains("__delete_keypair__") || kwargs.Contains("keypair") { + doRestart = true + var kpId string + + if kwargs.Contains("keypair") { + keypair, _ := kwargs.GetString("keypair") + iKp, err := KeypairManager.FetchByIdOrName(userCred, keypair) + if err != nil { + return nil, err + } + if iKp == nil { + return nil, fmt.Errorf("Fetch keypair error") + } + kp := iKp.(*SKeypair) + kpId = kp.Id + } + + if self.KeypairId != kpId { + okey := self.getKeypair() + if okey != nil { + kwargs.Set("delete_public_key", jsonutils.NewString(okey.PublicKey)) + } + + _, err := self.GetModelManager().TableSpec().Update(self, func() error { + self.KeypairId = kpId + return nil + }) + + if err != nil { + log.Errorf("update keypair fail: %s", err) + return nil, httperrors.NewInternalServerError(err.Error()) + } + + kwargs.Set("reset_password", jsonutils.JSONTrue) } } - return nil, nil + + deployStatus, err := self.GetDriver().GetDeployStatus() + if err != nil { + return nil, httperrors.NewInputParameterError(err.Error()) + } + + if utils.IsInStringArray(self.Status, deployStatus) { + if doRestart && self.Status == VM_RUNNING { + kwargs.Set("restart", jsonutils.JSONTrue) + } + err := self.StartGuestDeployTask(ctx, userCred, kwargs, "deploy", "") + if err != nil { + return nil, err + } + return nil, nil + } + + return nil, httperrors.NewServerStatusError("Cannot deploy in status %s", self.Status) } -func (self *SGuest) setUserData(ctx context.Context, userCred mcclient.TokenCredential, data string) error { - data = base64.StdEncoding.EncodeToString([]byte(data)) - if len(data) > 16*1024 { - return fmt.Errorf("User data is limited to 16 KB.") +func (self *SGuest) AllowPerformAttachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "attachdisk") +} + +func (self *SGuest) ValidateAttachDisk(ctx context.Context, disk *SDisk) error { + storage := disk.GetStorage() + if provider := storage.GetCloudprovider(); provider != nil { + host := self.GetHost() + if provider.Id != host.ManagerId { + return httperrors.NewInputParameterError("Disk %s and guest not belong to the same account", disk.Name) + } + if storage.ZoneId != host.ZoneId { + return httperrors.NewInputParameterError("Disk %s and guest not belong to the same zone", disk.Name) + } } - err := self.SetMetadata(ctx, "user_data", data, userCred) + + if disk.isAttached() { + return httperrors.NewInputParameterError("Disk %s has been attached", disk.Name) + } + if len(disk.GetPathAtHost(self.GetHost())) == 0 { + return httperrors.NewInputParameterError("Disk %s not belong the guest's host", disk.Name) + } + if disk.Status != DISK_READY { + return httperrors.NewInputParameterError("Disk in %s not able to attach", disk.Status) + } + guestStatus, err := self.GetDriver().GetAttachDiskStatus() if err != nil { return err } + if !utils.IsInStringArray(self.Status, guestStatus) { + return httperrors.NewInputParameterError("Guest %s not support attach disk in status %s", self.Name, self.Status) + } + return nil +} + +func (self *SGuest) PerformAttachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + diskId, err := data.GetString("disk_id") + if err != nil { + return nil, err + } + disk, err := DiskManager.FetchByIdOrName(userCred, diskId) + if err != nil { + return nil, err + } + if disk == nil { + return nil, httperrors.NewResourceNotFoundError("Disk %s not found", diskId) + } + if err := self.ValidateAttachDisk(ctx, disk.(*SDisk)); err != nil { + return nil, err + } + + taskData := data.(*jsonutils.JSONDict) + taskData.Set("disk_id", jsonutils.NewString(disk.GetId())) + + if err := self.GetDriver().StartGuestAttachDiskTask(ctx, userCred, self, taskData, ""); err != nil { + return nil, err + } + return nil, nil +} + +func (self *SGuest) StartSyncTask(ctx context.Context, userCred mcclient.TokenCredential, fw_only bool, parentTaskId string) error { + if !utils.IsInStringArray(self.Status, []string{VM_READY, VM_RUNNING}) { + return httperrors.NewResourceBusyError("Cannot sync in status %s", self.Status) + } + data := jsonutils.NewDict() + if fw_only { + data.Add(jsonutils.JSONTrue, "fw_only") + } else if err := self.SetStatus(userCred, VM_SYNC_CONFIG, ""); err != nil { + log.Errorf(err.Error()) + return err + } + if task, err := taskman.TaskManager.NewTask(ctx, "GuestSyncConfTask", self, userCred, data, parentTaskId, "", nil); err != nil { + log.Errorf(err.Error()) + return err + } else { + task.ScheduleRun(nil) + } + return nil +} + +func (self *SGuest) AllowPerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "suspend") +} + +func (self *SGuest) PerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + if self.Status == VM_RUNNING { + err := self.StartSuspendTask(ctx, userCred, "") + return nil, err + } + return nil, httperrors.NewInvalidStatusError("Cannot suspend VM in status %s", self.Status) +} + +func (self *SGuest) StartSuspendTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { + err := self.SetStatus(userCred, VM_SUSPEND, "do suspend") + if err != nil { + return err + } + return self.GetDriver().StartSuspendTask(ctx, userCred, self, nil, parentTaskId) +} + +func (self *SGuest) AllowPerformStart(ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "start") +} + +func (self *SGuest) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, + data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + if utils.IsInStringArray(self.Status, []string{VM_READY, VM_START_FAILED, VM_SAVE_DISK_FAILED, VM_SUSPEND}) { + if self.isAllDisksReady() { + var kwargs *jsonutils.JSONDict + if data != nil { + kwargs = data.(*jsonutils.JSONDict) + } + err := self.GetDriver().PerformStart(ctx, userCred, self, kwargs) + return nil, err + } else { + return nil, httperrors.NewInvalidStatusError("Some disk not ready") + } + } else { + return nil, httperrors.NewInvalidStatusError("Cannot do start server in status %s", self.Status) + } +} + +func (self *SGuest) StartGuestDeployTask(ctx context.Context, userCred mcclient.TokenCredential, kwargs *jsonutils.JSONDict, action string, parentTaskId string) error { + self.SetStatus(userCred, VM_START_DEPLOY, "") + if kwargs == nil { + kwargs = jsonutils.NewDict() + } + kwargs.Add(jsonutils.NewString(action), "deploy_action") + task, err := taskman.TaskManager.NewTask(ctx, "GuestDeployTask", self, userCred, kwargs, parentTaskId, "", nil) + if err != nil { + return err + } + task.ScheduleRun(nil) return nil } @@ -526,6 +538,20 @@ func (self *SGuest) NotifyAdminServerEvent(ctx context.Context, event string, pr return notifyclient.Notify(options.Options.NotifyAdminUser, event, priority, kwargs) } +func (self *SGuest) StartGuestStopTask(ctx context.Context, userCred mcclient.TokenCredential, isForce bool, parentTaskId string) error { + if len(parentTaskId) == 0 { + self.SetStatus(userCred, VM_START_STOP, "") + } + params := jsonutils.NewDict() + if isForce { + params.Add(jsonutils.JSONTrue, "is_force") + } + if len(parentTaskId) > 0 { + params.Add(jsonutils.JSONTrue, "subtask") + } + return self.GetDriver().StartGuestStopTask(self, ctx, userCred, params, parentTaskId) +} + func (self *SGuest) insertIso(imageId string) bool { cdrom := self.getCdrom() return cdrom.insertIso(imageId) @@ -551,12 +577,63 @@ func (self *SGuest) GetDetailsIso(userCred mcclient.TokenCredential) jsonutils.J return desc } +func (self *SGuest) StartInsertIsoTask(ctx context.Context, imageId string, hostId string, userCred mcclient.TokenCredential, parentTaskId string) error { + self.insertIso(imageId) + + data := jsonutils.NewDict() + data.Add(jsonutils.NewString(imageId), "image_id") + data.Add(jsonutils.NewString(hostId), "host_id") + + task, err := taskman.TaskManager.NewTask(ctx, "GuestInsertIsoTask", self, userCred, data, parentTaskId, "", nil) + if err != nil { + return err + } + task.ScheduleRun(nil) + return nil +} + +func (self *SGuest) StartGueststartTask(ctx context.Context, userCred mcclient.TokenCredential, data *jsonutils.JSONDict, parentTaskId string) error { + self.SetStatus(userCred, VM_START_START, "") + task, err := taskman.TaskManager.NewTask(ctx, "GuestStartTask", self, userCred, data, parentTaskId, "", nil) + if err != nil { + return err + } + task.ScheduleRun(nil) + return nil +} + +func (self *SGuest) StartGuestCreateTask(ctx context.Context, userCred mcclient.TokenCredential, params *jsonutils.JSONDict, pendingUsage quotas.IQuota, parentTaskId string) error { + return self.GetDriver().StartGuestCreateTask(self, ctx, userCred, params, pendingUsage, parentTaskId) +} + +func (self *SGuest) StartSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { + return self.GetDriver().StartGuestSyncstatusTask(self, ctx, userCred, parentTaskId) +} + +func (self *SGuest) StartAutoDeleteGuestTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { + db.OpsLog.LogEvent(self, db.ACT_DELETE, "auto-delete after stop", userCred) + return self.StartDeleteGuestTask(ctx, userCred, parentTaskId, false, false) +} + +func (self *SGuest) StartDeleteGuestTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string, isPurge bool, overridePendingDelete bool) error { + params := jsonutils.NewDict() + params.Add(jsonutils.NewString(self.Status), "guest_status") + if isPurge { + params.Add(jsonutils.JSONTrue, "purge") + } + if overridePendingDelete { + params.Add(jsonutils.JSONTrue, "override_pending_delete") + } + self.SetStatus(userCred, VM_START_DELETE, "") + return self.GetDriver().StartDeleteGuestTask(ctx, userCred, self, params, parentTaskId) +} + func (self *SGuest) AllowPerformAssignSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "assign-secgroup") } func (self *SGuest) AllowPerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "revoke-secgroup") } func (self *SGuest) PerformRevokeSecgroup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -607,7 +684,7 @@ func (self *SGuest) PerformAssignSecgroup(ctx context.Context, userCred mcclient } func (self *SGuest) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsAdmin(userCred) + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SGuest) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -635,7 +712,7 @@ func (self *SGuest) setKeypairId(userCred mcclient.TokenCredential, keypairId st } func (self *SGuest) AllowPerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "rebuild-root") } func (self *SGuest) PerformRebuildRoot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -742,7 +819,7 @@ func (self *SGuest) DetachDisk(ctx context.Context, disk *SDisk, userCred mcclie } func (self *SGuest) AllowPerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "createdisk") } func (self *SGuest) PerformCreatedisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -822,7 +899,7 @@ func (self *SGuest) StartGuestCreateDiskTask(ctx context.Context, userCred mccli } func (self *SGuest) AllowPerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "detachdisk") } func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -868,7 +945,7 @@ func (self *SGuest) PerformDetachdisk(ctx context.Context, userCred mcclient.Tok } func (self *SGuest) AllowPerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "detach-isolated-device") } func (self *SGuest) PerformDetachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -918,7 +995,7 @@ func (self *SGuest) detachIsolateDevice(userCred mcclient.TokenCredential, dev * } func (self *SGuest) AllowPerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "attach-isolated-device") } func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -956,7 +1033,7 @@ func (self *SGuest) PerformAttachIsolatedDevice(ctx context.Context, userCred mc } func (self *SGuest) AllowPerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "detachnetwork") } func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -978,7 +1055,7 @@ func (self *SGuest) PerformDetachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "attachnetwork") } func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1029,7 +1106,7 @@ func (self *SGuest) PerformAttachnetwork(ctx context.Context, userCred mcclient. } func (self *SGuest) AllowPerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsSystemAdmin() + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-bandwidth") } func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1063,7 +1140,7 @@ func (self *SGuest) PerformChangeBandwidth(ctx context.Context, userCred mcclien } func (self *SGuest) AllowPerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || self.IsAdmin(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "change-config") } func (self *SGuest) PerformChangeConfig(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1271,7 +1348,7 @@ func (self *SGuest) DoPendingDelete(ctx context.Context, userCred mcclient.Token } func (model *SGuest) AllowPerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, model, "cancel-delete") } func (self *SGuest) PerformCancelDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1303,8 +1380,79 @@ func (self *SGuest) StartUndeployGuestTask(ctx context.Context, userCred mcclien return nil } +func (self *SGuest) AllowPerformReset(ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "reset") +} + +func (self *SGuest) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, + data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + isHard := jsonutils.QueryBoolean(data, "is_hard", false) + if self.Status == VM_RUNNING || self.Status == VM_STOP_FAILED { + self.GetDriver().StartGuestResetTask(self, ctx, userCred, isHard, "") + return nil, nil + } + return nil, httperrors.NewInvalidStatusError("Cannot reset VM in status %s", self.Status) +} + +func (self *SGuest) AllowPerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "disk-snapshot") +} + +func (self *SGuest) PerformDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + if !utils.IsInStringArray(self.Status, []string{VM_RUNNING, VM_READY}) { + return nil, httperrors.NewInvalidStatusError("Cannot do snapshot when VM in status %s", self.Status) + } + diskId, err := data.GetString("disk_id") + if err != nil { + return nil, httperrors.NewBadRequestError(err.Error()) + } + name, err := data.GetString("name") + if err != nil { + return nil, httperrors.NewBadRequestError(err.Error()) + } + err = ValidateSnapshotName(self.Hypervisor, name, userCred.GetProjectId()) + if err != nil { + return nil, httperrors.NewBadRequestError(err.Error()) + } + if self.GetGuestDisk(diskId) == nil { + return nil, httperrors.NewNotFoundError("Guest disk %s not found", diskId) + } + if self.GetHypervisor() == HYPERVISOR_KVM { + q := SnapshotManager.Query() + cnt := q.Filter(sqlchemy.AND(sqlchemy.Equals(q.Field("disk_id"), diskId), + sqlchemy.Equals(q.Field("created_by"), MANUAL), + sqlchemy.Equals(q.Field("fake_deleted"), false))).Count() + if cnt >= options.Options.DefaultMaxManualSnapshotCount { + return nil, httperrors.NewBadRequestError("Disk %s snapshot full, cannot take any more", diskId) + } + pendingUsage := &SQuota{Snapshot: 1} + err = QuotaManager.CheckSetPendingQuota(ctx, userCred, self.ProjectId, pendingUsage) + if err != nil { + return nil, httperrors.NewBadRequestError("Check set pending quota error %s", err) + } + snapshot, err := SnapshotManager.CreateSnapshot(ctx, userCred, MANUAL, diskId, self.Id, "", name) + QuotaManager.CancelPendingUsage(ctx, userCred, self.ProjectId, nil, pendingUsage) + if err != nil { + return nil, err + } + err = self.StartDiskSnapshot(ctx, userCred, diskId, snapshot.Id) + return nil, err + } else { + snapshot, err := SnapshotManager.CreateSnapshot(ctx, userCred, MANUAL, diskId, self.Id, "", name) + if err != nil { + return nil, err + } + err = self.StartDiskSnapshot(ctx, userCred, diskId, snapshot.Id) + return nil, err + } + +} + func (self *SGuest) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "syncstatus") } func (self *SGuest) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1313,10 +1461,6 @@ func (self *SGuest) PerformSyncstatus(ctx context.Context, userCred mcclient.Tok return nil, err } -func (self *SGuest) StartSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { - return self.GetDriver().StartGuestSyncstatusTask(self, ctx, userCred, parentTaskId) -} - func (self *SGuest) isNotRunningStatus(status string) bool { if status == VM_READY || status == VM_SUSPEND { return true @@ -1340,432 +1484,289 @@ func (self *SGuest) PerformStatus(ctx context.Context, userCred mcclient.TokenCr return nil, nil } -func (self *SGuest) StartAutoDeleteGuestTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { - db.OpsLog.LogEvent(self, db.ACT_DELETE, "auto-delete after stop", userCred) - return self.StartDeleteGuestTask(ctx, userCred, parentTaskId, false, false) -} - -func (self *SGuest) StartDeleteGuestTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string, isPurge bool, overridePendingDelete bool) error { +func (self *SGuest) StartDiskSnapshot(ctx context.Context, userCred mcclient.TokenCredential, diskId, snapshotId string) error { + self.SetStatus(userCred, VM_START_SNAPSHOT, "StartDiskSnapshot") params := jsonutils.NewDict() - params.Add(jsonutils.NewString(self.Status), "guest_status") - if isPurge { - params.Add(jsonutils.JSONTrue, "purge") - } - if overridePendingDelete { - params.Add(jsonutils.JSONTrue, "override_pending_delete") - } - self.SetStatus(userCred, VM_START_DELETE, "") - return self.GetDriver().StartDeleteGuestTask(ctx, userCred, self, params, parentTaskId) + params.Set("disk_id", jsonutils.NewString(diskId)) + params.Set("snapshot_id", jsonutils.NewString(snapshotId)) + return self.GetDriver().StartGuestDiskSnapshotTask(ctx, userCred, self, params) } -func (self *SGuest) AllowPerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SGuest) AllowPerformStop(ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "stop") } -func (self *SGuest) PerformSaveImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - if !utils.IsInStringArray(self.Status, []string{VM_READY}) { - return nil, httperrors.NewInputParameterError("Cannot save image in status %s", self.Status) - } else if !data.Contains("name") { - return nil, httperrors.NewInputParameterError("Image name is required") - } else if disks := self.CategorizeDisks(); disks.Root == nil { - return nil, httperrors.NewInputParameterError("No root image") +func (self *SGuest) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, + data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + // XXX if is force, force stop guest + var isForce = jsonutils.QueryBoolean(data, "is_force", false) + if isForce || utils.IsInStringArray(self.Status, []string{VM_RUNNING, VM_STOP_FAILED}) { + return nil, self.StartGuestStopTask(ctx, userCred, isForce, "") } else { - kwargs := data.(*jsonutils.JSONDict) - restart := self.Status == VM_RUNNING - properties := jsonutils.NewDict() - if notes, err := data.GetString("notes"); err != nil && len(notes) > 0 { - properties.Add(jsonutils.NewString(notes), "notes") - } - properties.Add(jsonutils.NewString(self.OsType), "os_type") - kwargs.Add(properties, "properties") - kwargs.Add(jsonutils.NewBool(restart), "restart") - - lockman.LockObject(ctx, disks.Root) - defer lockman.ReleaseObject(ctx, disks.Root) - - if imageId, err := disks.Root.PrepareSaveImage(ctx, userCred, kwargs); err != nil { - return nil, err - } else { - kwargs.Add(jsonutils.NewString(imageId), "image_id") - } - return nil, self.StartGuestSaveImage(ctx, userCred, kwargs, "") + return nil, httperrors.NewInvalidStatusError("Cannot stop server in status %s", self.Status) } } -func (self *SGuest) StartGuestSaveImage(ctx context.Context, userCred mcclient.TokenCredential, data *jsonutils.JSONDict, parentTaskId string) error { - return self.GetDriver().StartGuestSaveImage(ctx, userCred, self, data, parentTaskId) +func (self *SGuest) AllowPerformRestart(ctx context.Context, + userCred mcclient.TokenCredential, + query jsonutils.JSONObject, + data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "restart") } -func (self *SGuest) AllowPerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SGuest) PerformRestart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + isForce := jsonutils.QueryBoolean(data, "is_force", false) + if utils.IsInStringArray(self.Status, []string{VM_RUNNING, VM_STOP_FAILED}) || (isForce && self.Status == VM_STOPPING) { + return nil, self.GetDriver().StartGuestRestartTask(self, ctx, userCred, isForce, "") + } else { + return nil, httperrors.NewInvalidStatusError("Cannot do restart server in status %s", self.Status) + } } -func (self *SGuest) PerformSync(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - if err := self.StartSyncTask(ctx, userCred, false, ""); err != nil { +func (self *SGuest) AllowPerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "sendkeys") +} + +func (self *SGuest) PerformSendkeys(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + if self.Hypervisor != HYPERVISOR_KVM { + return nil, httperrors.NewUnsupportOperationError("Not allow for hypervisor %s", self.Hypervisor) + } + if self.Status != VM_RUNNING { + return nil, httperrors.NewInvalidStatusError("Cannot send keys in status %s", self.Status) + } + keys, err := data.GetString("keys") + if err != nil { return nil, err } - return nil, nil + err = self.VerifySendKeys(keys) + if err != nil { + return nil, httperrors.NewBadRequestError(err.Error()) + } + cmd := fmt.Sprintf("sendkey %s", keys) + duration, err := data.Int("duration") + if err == nil { + cmd = fmt.Sprintf("%s %d", cmd, duration) + } + _, err = self.SendMonitorCommand(ctx, userCred, cmd) + return nil, err } -func (self *SGuest) GetQemuVersion(userCred mcclient.TokenCredential) string { - return self.GetMetadata("__qemu_version", userCred) +func (self *SGuest) VerifySendKeys(keyStr string) error { + keys := strings.Split(keyStr, "-") + for _, key := range keys { + if !self.IsLegalKey(key) { + return fmt.Errorf("Unknown key '%s'", key) + } + } + return nil } -// if qemuVer >= compareVer return true -func (self *SGuest) CheckQemuVersion(qemuVer, compareVer string) bool { - if len(qemuVer) == 0 { +func (self *SGuest) IsLegalKey(key string) bool { + singleKeys := "1234567890abcdefghijklmnopqrstuvwxyz" + legalKeys := []string{"ctrl", "ctrl_r", "alt", "alt_r", "shift", "shift_r", + "delete", "esc", "insert", "print", "spc", + "f1", "f2", "f3", "f4", "f5", "f6", + "f7", "f8", "f9", "f10", "f11", "f12", + "home", "pgup", "pgdn", "end", + "up", "down", "left", "right", + "tab", "minus", "equal", "backspace", "backslash", + "bracket_left", "bracket_right", "backslash", + "semicolon", "apostrophe", "grave_accent", "ret", + "comma", "dot", "slash", + "caps_lock", "num_lock", "scroll_lock"} + if len(key) > 1 && !utils.IsInStringArray(key, legalKeys) { return false - } - - compareVersion := strings.Split(compareVer, ".") - guestVersion := strings.Split(qemuVer, ".") - var i = 0 - for ; i < len(guestVersion); i++ { - if i >= len(compareVersion) { - return true - } - v, _ := strconv.ParseInt(guestVersion[i], 10, 0) - compareV, _ := strconv.ParseInt(compareVersion[i], 10, 0) - if v < compareV { - return false - } else if v > compareV { - return true - } - } - if i < len(compareVersion)-1 { + } else if len(key) == 1 && !strings.Contains(singleKeys, key) { return false } return true } -func (self *SGuest) AllowPerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SGuest) SendMonitorCommand(ctx context.Context, userCred mcclient.TokenCredential, cmd string) (jsonutils.JSONObject, error) { + host := self.GetHost() + url := fmt.Sprintf("%s/servers/%s/monitor", host.ManagerUri, self.Id) + header := http.Header{} + header.Add("X-Auth-Token", userCred.GetTokenString()) + body := jsonutils.NewDict() + body.Add(jsonutils.NewString(cmd), "cmd") + _, res, err := httputils.JSONRequest(httputils.GetDefaultClient(), ctx, "POST", url, header, body, false) + if err != nil { + return nil, err + } + ret := res.(*jsonutils.JSONDict) + return ret, nil } -func (self *SGuest) PerformMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - if self.GetHypervisor() != HYPERVISOR_KVM { - return nil, httperrors.NewNotAcceptableError("Not allow for hypervisor %s", self.GetHypervisor()) +func (self *SGuest) AllowPerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "associate-eip") +} + +func (self *SGuest) PerformAssociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + if !utils.IsInStringArray(self.Status, []string{VM_READY, VM_RUNNING}) { + return nil, httperrors.NewInvalidStatusError("cannot associate eip in status %s", self.Status) } - isRescueMode := jsonutils.QueryBoolean(data, "rescue_mode", false) - if !isRescueMode && self.Status != VM_READY { - return nil, httperrors.NewServerStatusError("Cannot normal migrate guest in status %s, try rescue mode or server-live-migrate?", self.Status) + + eip, err := self.GetEip() + if err != nil { + log.Errorf("Fail to get Eip %s", err) + return nil, httperrors.NewGeneralError(err) } - if isRescueMode { - guestDisks := self.GetDisks() - for _, guestDisk := range guestDisks { - if utils.IsInStringArray( - guestDisk.GetDisk().GetStorage().StorageType, STORAGE_LOCAL_TYPES) { - return nil, httperrors.NewBadRequestError("Rescue mode requires all disk store in shared storages") - } + if eip != nil { + return nil, httperrors.NewInvalidStatusError("already associate with eip") + } + eipStr := jsonutils.GetAnyString(data, []string{"eip", "eip_id"}) + if len(eipStr) == 0 { + return nil, httperrors.NewInputParameterError("missing eip or eip_id") + } + eipObj, err := ElasticipManager.FetchByIdOrName(userCred, eipStr) + if err != nil { + if err == sql.ErrNoRows { + return nil, httperrors.NewResourceNotFoundError("eip %s not found", eipStr) + } else { + return nil, httperrors.NewGeneralError(err) } } - devices := self.GetIsolatedDevices() - if devices != nil && len(devices) > 0 { - return nil, httperrors.NewBadRequestError("Cannot migrate with isolated devices") + + eip = eipObj.(*SElasticip) + eipRegion := eip.GetRegion() + instRegion := self.getRegion() + + if eip.Mode == EIP_MODE_INSTANCE_PUBLICIP { + return nil, httperrors.NewUnsupportOperationError("fixed eip cannot be associated") } - var preferHostId string - preferHost, _ := data.GetString("prefer_host") - if len(preferHost) > 0 { - if !userCred.IsSystemAdmin() { - return nil, httperrors.NewBadRequestError("Only system admin can assign host") - } - iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) - if iHost == nil { - return nil, httperrors.NewBadRequestError("Host %s not found", preferHost) - } - host := iHost.(*SHost) - preferHostId = host.Id + + eipVm := eip.GetAssociateVM() + if eipVm != nil { + return nil, httperrors.NewConflictError("eip has been associated") } - err := self.StartMigrateTask(ctx, userCred, isRescueMode, self.Status, preferHostId, "") + + if eipRegion.Id != instRegion.Id { + return nil, httperrors.NewInputParameterError("cannot associate eip and instance in different region") + } + + host := self.GetHost() + if host == nil { + return nil, httperrors.NewInputParameterError("server host is not found???") + } + + if host.ManagerId != eip.ManagerId { + return nil, httperrors.NewInputParameterError("cannot associate eip and instance in different provider") + } + + self.SetStatus(userCred, VM_ASSOCIATE_EIP, "associate eip") + + params := jsonutils.NewDict() + params.Add(jsonutils.NewString(self.ExternalId), "instance_external_id") + params.Add(jsonutils.NewString(self.Id), "instance_id") + params.Add(jsonutils.NewString(EIP_ASSOCIATE_TYPE_SERVER), "instance_type") + + err = eip.StartEipAssociateTask(ctx, userCred, params) + return nil, err } -func (self *SGuest) StartMigrateTask(ctx context.Context, userCred mcclient.TokenCredential, isRescueMode bool, guestStatus, preferHostId, parentTaskId string) error { - data := jsonutils.NewDict() - if isRescueMode { - data.Set("is_rescue_mode", jsonutils.JSONTrue) - } - if len(preferHostId) > 0 { - data.Set("prefer_host_id", jsonutils.NewString(preferHostId)) - } - data.Set("guest_status", jsonutils.NewString(guestStatus)) - if task, err := taskman.TaskManager.NewTask(ctx, "GuestMigrateTask", self, userCred, data, parentTaskId, "", nil); err != nil { - log.Errorf(err.Error()) - return err - } else { - task.ScheduleRun(nil) - } - return nil +func (self *SGuest) AllowPerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "dissociate-eip") } -func (self *SGuest) AllowPerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) PerformLiveMigrate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - if self.GetHypervisor() != HYPERVISOR_KVM { - return nil, httperrors.NewNotAcceptableError("Not allow for hypervisor %s", self.GetHypervisor()) - } - imageId := self.GetDisks()[0].GetDisk().TemplateId - image, err := CachedimageManager.GetImageById(ctx, userCred, imageId, false) +func (self *SGuest) PerformDissociateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + eip, err := self.GetEip() if err != nil { - return nil, err + log.Errorf("Fail to get Eip %s", err) + return nil, httperrors.NewGeneralError(err) } - if image.DiskFormat != "qcow2" { - return nil, httperrors.NewBadRequestError("Live migrate only support image fromat qocw2") - } - if utils.IsInStringArray(self.Status, []string{VM_RUNNING, VM_SUSPEND}) { - cdrom := self.getCdrom() - if cdrom != nil && len(cdrom.ImageId) > 0 { - return nil, httperrors.NewBadRequestError("Cannot migrate with cdrom") - } - devices := self.GetIsolatedDevices() - if devices != nil && len(devices) > 0 { - return nil, httperrors.NewBadRequestError("Cannot migrate with isolated devices") - } - if !self.CheckQemuVersion(self.GetQemuVersion(userCred), "1.1.2") { - return nil, httperrors.NewBadRequestError("Cannot do live migrate, too low qemu version") - } - var preferHostId string - preferHost, _ := data.GetString("prefer_host") - if len(preferHost) > 0 { - if !userCred.IsSystemAdmin() { - return nil, httperrors.NewBadRequestError("Only system admin can assign host") - } - iHost, _ := HostManager.FetchByIdOrName(userCred, preferHost) - if iHost == nil { - return nil, httperrors.NewBadRequestError("Host %s not found", preferHost) - } - host := iHost.(*SHost) - preferHostId = host.Id - } - err := self.StartGuestLiveMigrateTask(ctx, userCred, self.Status, preferHostId, "") - return nil, err - } - return nil, httperrors.NewBadRequestError("Cannot live migrate in status %s", self.Status) -} - -func (self *SGuest) StartGuestLiveMigrateTask(ctx context.Context, userCred mcclient.TokenCredential, guestStatus, preferHostId, parentTaskId string) error { - self.SetStatus(userCred, VM_START_MIGRATE, "") - data := jsonutils.NewDict() - if len(preferHostId) > 0 { - data.Set("prefer_host_id", jsonutils.NewString(preferHostId)) - } - data.Set("guest_status", jsonutils.NewString(guestStatus)) - if task, err := taskman.TaskManager.NewTask(ctx, "GuestLiveMigrateTask", self, userCred, data, parentTaskId, "", nil); err != nil { - log.Errorf(err.Error()) - return err - } else { - task.ScheduleRun(nil) - } - return nil -} - -func (self *SGuest) AllowPerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) PerformDeploy(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - kwargs, ok := data.(*jsonutils.JSONDict) - if !ok { - return nil, fmt.Errorf("Parse query body error") + if eip == nil { + return nil, httperrors.NewInvalidStatusError("No eip to dissociate") } - // 变更密码/密钥时需要Restart才能生效。更新普通字段不需要Restart - doRestart := false - if kwargs.Contains("__delete_keypair__") || kwargs.Contains("keypair") { - doRestart = true - var kpId string + self.SetStatus(userCred, VM_DISSOCIATE_EIP, "associate eip") - if kwargs.Contains("keypair") { - keypair, _ := kwargs.GetString("keypair") - iKp, err := KeypairManager.FetchByIdOrName(userCred, keypair) - if err != nil { - return nil, err - } - if iKp == nil { - return nil, fmt.Errorf("Fetch keypair error") - } - kp := iKp.(*SKeypair) - kpId = kp.Id - } - - if self.KeypairId != kpId { - okey := self.getKeypair() - if okey != nil { - kwargs.Set("delete_public_key", jsonutils.NewString(okey.PublicKey)) - } - - _, err := self.GetModelManager().TableSpec().Update(self, func() error { - self.KeypairId = kpId - return nil - }) - - if err != nil { - log.Errorf("update keypair fail: %s", err) - return nil, httperrors.NewInternalServerError(err.Error()) - } - - kwargs.Set("reset_password", jsonutils.JSONTrue) - } - } - - deployStatus, err := self.GetDriver().GetDeployStatus() + err = eip.StartEipDissociateTask(ctx, userCred, "") if err != nil { - return nil, httperrors.NewInputParameterError(err.Error()) - } - - if utils.IsInStringArray(self.Status, deployStatus) { - if doRestart && self.Status == VM_RUNNING { - kwargs.Set("restart", jsonutils.JSONTrue) - } - err := self.StartGuestDeployTask(ctx, userCred, kwargs, "deploy", "") - if err != nil { - return nil, err - } - return nil, nil - } - - return nil, httperrors.NewServerStatusError("Cannot deploy in status %s", self.Status) -} - -func (self *SGuest) StartGuestDeployTask(ctx context.Context, userCred mcclient.TokenCredential, kwargs *jsonutils.JSONDict, action string, parentTaskId string) error { - self.SetStatus(userCred, VM_START_DEPLOY, "") - if kwargs == nil { - kwargs = jsonutils.NewDict() - } - kwargs.Add(jsonutils.NewString(action), "deploy_action") - task, err := taskman.TaskManager.NewTask(ctx, "GuestDeployTask", self, userCred, kwargs, parentTaskId, "", nil) - if err != nil { - return err - } - task.ScheduleRun(nil) - return nil -} - -func (self *SGuest) AllowPerformAttachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) ValidateAttachDisk(ctx context.Context, disk *SDisk) error { - storage := disk.GetStorage() - if provider := storage.GetCloudprovider(); provider != nil { - host := self.GetHost() - if provider.Id != host.ManagerId { - return httperrors.NewInputParameterError("Disk %s and guest not belong to the same account", disk.Name) - } - if storage.ZoneId != host.ZoneId { - return httperrors.NewInputParameterError("Disk %s and guest not belong to the same zone", disk.Name) - } - } - - if disk.isAttached() { - return httperrors.NewInputParameterError("Disk %s has been attached", disk.Name) - } - if len(disk.GetPathAtHost(self.GetHost())) == 0 { - return httperrors.NewInputParameterError("Disk %s not belong the guest's host", disk.Name) - } - if disk.Status != DISK_READY { - return httperrors.NewInputParameterError("Disk in %s not able to attach", disk.Status) - } - guestStatus, err := self.GetDriver().GetAttachDiskStatus() - if err != nil { - return err - } - if !utils.IsInStringArray(self.Status, guestStatus) { - return httperrors.NewInputParameterError("Guest %s not support attach disk in status %s", self.Name, self.Status) - } - return nil -} - -func (self *SGuest) PerformAttachdisk(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - diskId, err := data.GetString("disk_id") - if err != nil { - return nil, err - } - disk, err := DiskManager.FetchByIdOrName(userCred, diskId) - if err != nil { - return nil, err - } - if disk == nil { - return nil, httperrors.NewResourceNotFoundError("Disk %s not found", diskId) - } - if err := self.ValidateAttachDisk(ctx, disk.(*SDisk)); err != nil { - return nil, err - } - - taskData := data.(*jsonutils.JSONDict) - taskData.Set("disk_id", jsonutils.NewString(disk.GetId())) - - if err := self.GetDriver().StartGuestAttachDiskTask(ctx, userCred, self, taskData, ""); err != nil { - return nil, err + log.Errorf("fail to start dissociate task %s", err) + return nil, httperrors.NewGeneralError(err) } return nil, nil } -func (self *SGuest) StartSyncTask(ctx context.Context, userCred mcclient.TokenCredential, fw_only bool, parentTaskId string) error { - if !utils.IsInStringArray(self.Status, []string{VM_READY, VM_RUNNING}) { - return httperrors.NewResourceBusyError("Cannot sync in status %s", self.Status) +func (self *SGuest) AllowPerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "create-eip") +} + +func (self *SGuest) PerformCreateEip(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + bw, err := data.Int("bandwidth") + if err != nil { + return nil, httperrors.NewInputParameterError("Missing bandwidth") } - data := jsonutils.NewDict() - if fw_only { - data.Add(jsonutils.JSONTrue, "fw_only") - } else if err := self.SetStatus(userCred, VM_SYNC_CONFIG, ""); err != nil { - log.Errorf(err.Error()) - return err + + chargeType, _ := data.GetString("charge_type") + if len(chargeType) == 0 { + chargeType = EIP_CHARGE_TYPE_DEFAULT } - if task, err := taskman.TaskManager.NewTask(ctx, "GuestSyncConfTask", self, userCred, data, parentTaskId, "", nil); err != nil { - log.Errorf(err.Error()) + + if len(self.ExternalId) == 0 { + return nil, httperrors.NewInvalidStatusError("Not a managed VM") + } + host := self.GetHost() + if host == nil { + return nil, httperrors.NewInvalidStatusError("No host???") + } + + _, err = host.GetDriver() + if err != nil { + return nil, httperrors.NewInvalidStatusError("No valid cloud provider") + } + + region := host.GetRegion() + if region == nil { + return nil, httperrors.NewInvalidStatusError("No cloudregion???") + } + + err = ElasticipManager.allocateEipAndAssociateVM(ctx, userCred, self, int(bw), chargeType, host.ManagerId, region.Id) + if err != nil { + return nil, httperrors.NewGeneralError(err) + } + + self.SetStatus(userCred, VM_ASSOCIATE_EIP, "allocate and associate EIP") + + return nil, nil +} + +func (self *SGuest) setUserData(ctx context.Context, userCred mcclient.TokenCredential, data string) error { + data = base64.StdEncoding.EncodeToString([]byte(data)) + if len(data) > 16*1024 { + return fmt.Errorf("User data is limited to 16 KB.") + } + err := self.SetMetadata(ctx, "user_data", data, userCred) + if err != nil { return err - } else { - task.ScheduleRun(nil) } return nil } -func (self *SGuest) AllowPerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SGuest) AllowPerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "userdata") } -func (self *SGuest) PerformSuspend(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - if self.Status == VM_RUNNING { - err := self.StartSuspendTask(ctx, userCred, "") - return nil, err - } - return nil, httperrors.NewInvalidStatusError("Cannot suspend VM in status %s", self.Status) -} - -func (self *SGuest) StartSuspendTask(ctx context.Context, userCred mcclient.TokenCredential, parentTaskId string) error { - err := self.SetStatus(userCred, VM_SUSPEND, "do suspend") +func (self *SGuest) PerformUserData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + userData, err := data.GetString("user_data") if err != nil { - return err + return nil, httperrors.NewInputParameterError("missing user_data %s", err) } - return self.GetDriver().StartSuspendTask(ctx, userCred, self, nil, parentTaskId) -} - -func (self *SGuest) AllowPerformStart(ctx context.Context, - userCred mcclient.TokenCredential, - query jsonutils.JSONObject, - data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) -} - -func (self *SGuest) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, - data jsonutils.JSONObject) (jsonutils.JSONObject, error) { - if utils.IsInStringArray(self.Status, []string{VM_READY, VM_START_FAILED, VM_SAVE_DISK_FAILED, VM_SUSPEND}) { - if self.isAllDisksReady() { - var kwargs *jsonutils.JSONDict - if data != nil { - kwargs = data.(*jsonutils.JSONDict) - } - err := self.GetDriver().PerformStart(ctx, userCred, self, kwargs) - return nil, err - } else { - return nil, httperrors.NewInvalidStatusError("Some disk not ready") + err = self.setUserData(ctx, userCred, userData) + if err != nil { + return nil, httperrors.NewGeneralError(err) + } + if len(self.HostId) > 0 { + err = self.StartSyncTask(ctx, userCred, false, "") + if err != nil { + return nil, httperrors.NewGeneralError(err) } - } else { - return nil, httperrors.NewInvalidStatusError("Cannot do start server in status %s", self.Status) } + return nil, nil } func (self *SGuest) SwitchToBackup() error { @@ -1777,7 +1778,7 @@ func (self *SGuest) SwitchToBackup() error { } func (self *SGuest) AllowPerformSwitchToBackup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsAdmin(userCred) + return db.IsAdminAllowPerform(userCred, self, "switch-to-backup") } func (self *SGuest) PerformSwitchToBackup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1797,7 +1798,7 @@ func (self *SGuest) PerformSwitchToBackup(ctx context.Context, userCred mcclient } func (manager *SGuestManager) AllowPerformDirtyServerStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() || userCred.IsAdmin() + return db.IsAdminAllowClassPerform(userCred, manager, "dirty-server-start") } func (manager *SGuestManager) PerformDirtyServerStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1843,7 +1844,7 @@ func (guest *SGuest) GuestStartAndSyncToBackup(ctx context.Context, userCred mcc } func (self *SGuest) AllowPerformCreateBackup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsAdmin(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "create-backup") } func (self *SGuest) PerformCreateBackup(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1905,3 +1906,45 @@ func (self *SGuest) StartCreateBackup(ctx context.Context, userCred mcclient.Tok } return nil } + +func (self *SGuest) AllowPerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowPerform(userCred, self, "set-extra-option") +} + +func (self *SGuest) PerformSetExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + key, err := data.GetString("key") + if err != nil { + return nil, httperrors.NewBadRequestError("Option key required") + } + value, _ := data.GetString("value") + extraOptions := self.GetExtraOptions(userCred) + extraOptions.Set(key, jsonutils.NewString(value)) + return nil, self.SetExtraOptions(ctx, userCred, extraOptions) +} + +func (self *SGuest) GetExtraOptions(userCred mcclient.TokenCredential) *jsonutils.JSONDict { + options := self.GetMetadataJson("extra_options", userCred) + o, ok := options.(*jsonutils.JSONDict) + if ok { + return o + } + return jsonutils.NewDict() +} + +func (self *SGuest) SetExtraOptions(ctx context.Context, userCred mcclient.TokenCredential, extraOptions *jsonutils.JSONDict) error { + return self.SetMetadata(ctx, "extra_options", extraOptions, userCred) +} + +func (self *SGuest) AllowPerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowPerform(userCred, self, "del-extra-option") +} + +func (self *SGuest) PerformDelExtraOption(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { + key, err := data.GetString("key") + if err != nil { + return nil, httperrors.NewBadRequestError("Option key required") + } + extraOptions := self.GetExtraOptions(userCred) + extraOptions.Remove(key) + return nil, self.SetExtraOptions(ctx, userCred, extraOptions) +} diff --git a/pkg/compute/models/guests.go b/pkg/compute/models/guests.go index a47f76d641..802ee17dbb 100644 --- a/pkg/compute/models/guests.go +++ b/pkg/compute/models/guests.go @@ -108,8 +108,10 @@ const ( VM_RESTORE_STATE = "restore_state" VM_RESTORE_FAILED = "restore_failed" - VM_ASSOCIATE_EIP = "associate_eip" - VM_DISSOCIATE_EIP = "dissociate_eip" + VM_ASSOCIATE_EIP = "associate_eip" + VM_ASSOCIATE_EIP_FAILED = "associate_eip_failed" + VM_DISSOCIATE_EIP = "dissociate_eip" + VM_DISSOCIATE_EIP_FAILED = "dissociate_eip_failed" VM_REMOVE_STATEFILE = "remove_state" @@ -217,7 +219,7 @@ type SGuest struct { func (manager *SGuestManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { if query.Contains("host") || query.Contains("wire") || query.Contains("zone") { - if !userCred.IsSystemAdmin() { + if !db.IsAdminAllowList(userCred, manager) { return false } } @@ -985,7 +987,7 @@ func (self *SGuest) getExtBandwidth() int { func (self *SGuest) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { extra := self.SVirtualResourceBase.GetCustomizeColumns(ctx, userCred, query) - if userCred.IsSystemAdmin() { + if db.IsAdminAllowGet(userCred, self) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.Name), "host") @@ -1078,7 +1080,7 @@ func (self *SGuest) GetExtraDetails(ctx context.Context, userCred mcclient.Token if metaData, err := self.GetAllMetadata(userCred); err == nil { extra.Add(jsonutils.Marshal(metaData), "metadata") } - if userCred.IsSystemAdmin() { + if db.IsAdminAllowGet(userCred, self) { host := self.GetHost() if host != nil { extra.Add(jsonutils.NewString(host.GetName()), "host") @@ -2334,10 +2336,10 @@ func (self *SGuest) AllowDeleteItem(ctx context.Context, userCred mcclient.Token overridePendingDelete = jsonutils.QueryBoolean(data, "override_pending_delete", false) purge = jsonutils.QueryBoolean(data, "purge", false) } - if (overridePendingDelete || purge) && !userCred.IsSystemAdmin() { + if (overridePendingDelete || purge) && !db.IsAdminAllowDelete(userCred, self) { return false } - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } func (self *SGuest) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { diff --git a/pkg/compute/models/helper.go b/pkg/compute/models/helper.go index 41e680cdf6..83575fd8ac 100644 --- a/pkg/compute/models/helper.go +++ b/pkg/compute/models/helper.go @@ -10,8 +10,10 @@ import ( "yunion.io/x/log" "yunion.io/x/pkg/utils" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" "yunion.io/x/onecloud/pkg/cloudcommon/db/taskman" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" ) @@ -47,7 +49,7 @@ func ValidateScheduleCreateData(ctx context.Context, userCred mcclient.TokenCred // base validate_create_data if (data.Contains("prefer_baremetal") || data.Contains("prefer_host")) && hypervisor != HYPERVISOR_CONTAINER { - if !userCred.IsSystemAdmin() { + if !userCred.IsAdminAllow(consts.GetServiceType(), GuestManager.KeywordPlural(), policy.PolicyActionPerform, "assign-host") { return nil, httperrors.NewNotSufficientPrivilegeError("Only system admin can specify preferred host") } bmName, _ := data.GetString("prefer_host") diff --git a/pkg/compute/models/hostjoints.go b/pkg/compute/models/hostjoints.go index c6477c1877..ccc1aaabab 100644 --- a/pkg/compute/models/hostjoints.go +++ b/pkg/compute/models/hostjoints.go @@ -31,29 +31,29 @@ type SHostJointsBase struct { } func (manager *SHostJointsManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowList(userCred, manager) } func (manager *SHostJointsManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowCreate(userCred, manager) } func (manager *SHostJointsManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowList(userCred, manager) } func (manager *SHostJointsManager) AllowAttach(ctx context.Context, userCred mcclient.TokenCredential, master db.IStandaloneModel, slave db.IStandaloneModel) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowCreate(userCred, manager) } func (self *SHostJointsBase) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowGet(userCred, self) } func (self *SHostJointsBase) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowUpdate(userCred, self) } func (self *SHostJointsBase) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowDelete(userCred, self) } diff --git a/pkg/compute/models/hosts.go b/pkg/compute/models/hosts.go index 108c0446a9..477ddb3fd5 100644 --- a/pkg/compute/models/hosts.go +++ b/pkg/compute/models/hosts.go @@ -91,7 +91,6 @@ var NIC_TYPES = []string{NIC_TYPE_IPMI, NIC_TYPE_ADMIN} type SHostManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var HostManager *SHostManager @@ -110,7 +109,6 @@ func init() { type SHost struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure SManagedResourceBase Rack string `width:"16" charset:"ascii" nullable:"true" get:"admin" update:"admin" create:"admin_optional"` // Column(VARCHAR(16, charset='ascii'), nullable=True) @@ -145,7 +143,7 @@ type SHost struct { // Status string = Column(VARCHAR(16, charset='ascii'), nullable=False, default=baremetalstatus.INIT) # status HostStatus string `width:"16" charset:"ascii" nullable:"false" default:"offline" list:"admin"` // Column(VARCHAR(16, charset='ascii'), nullable=False, server_default=HOST_OFFLINE, default=HOST_OFFLINE) - ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_required"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False) + ZoneId string `width:"128" charset:"ascii" nullable:"false" list:"admin" create:"admin_optional"` // Column(VARCHAR(ID_LENGTH, charset='ascii'), nullable=False) HostType string `width:"36" charset:"ascii" nullable:"false" list:"admin" update:"admin" create:"admin_required"` // Column(VARCHAR(36, charset='ascii'), nullable=False) @@ -162,16 +160,24 @@ func (manager *SHostManager) GetContextManager() []db.IModelManager { return []db.IModelManager{ZoneManager} } -func (manager *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - zoneId, err := data.GetString("zone_id") - if err != nil { - return false - } - _, err = ZoneManager.FetchById(zoneId) - if err != nil { - return false - } - return userCred.IsSystemAdmin() +func (self *SHostManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SHostManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SHost) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SHost) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SHost) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) } func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -264,6 +270,9 @@ func (manager *SHostManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQu } func (self *SHost) GetZone() *SZone { + if len(self.ZoneId) == 0 { + return nil + } zone, _ := ZoneManager.FetchById(self.ZoneId) if zone != nil { return zone.(*SZone) @@ -1852,7 +1861,7 @@ func (self *SHost) GetExtraDetails(ctx context.Context, userCred mcclient.TokenC } func (self *SHost) AllowGetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowGetSpec(userCred, self, "vnc") } func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1867,7 +1876,7 @@ func (self *SHost) GetDetailsVnc(ctx context.Context, userCred mcclient.TokenCre } func (self *SHost) AllowGetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowGetSpec(userCred, self, "ipmi") } func (self *SHost) GetDetailsIpmi(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2003,7 +2012,7 @@ func (manager *SHostManager) ValidateSizeParams(data *jsonutils.JSONDict) (*json func (manager *SHostManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { zoneId, _ := data.GetString("zone_id") - if len(zoneId) == 0 || ZoneManager.Query().Equals("id", zoneId).Count() == 0 { + if len(zoneId) > 0 && ZoneManager.Query().Equals("id", zoneId).Count() == 0 { return nil, httperrors.NewInputParameterError("Zone id %s not found", zoneId) } mangerUri, err := data.GetString("manager_uri") @@ -2158,7 +2167,7 @@ func (self *SHost) AllowPerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "start") } func (self *SHost) PerformStart(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2193,7 +2202,7 @@ func (self *SHost) AllowPerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "stop") } func (self *SHost) PerformStop(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, @@ -2243,7 +2252,8 @@ func (self *SHost) AllowPerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "maintenance") + } func (self *SHost) PerformMaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2282,7 +2292,7 @@ func (self *SHost) AllowPerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "unmaintenance") } func (self *SHost) PerformUnmaintenance(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2344,7 +2354,7 @@ func (self *SHost) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "offline") } func (self *SHost) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2363,7 +2373,7 @@ func (self *SHost) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "online") } func (self *SHost) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2396,7 +2406,7 @@ func (self *SHost) AllowPerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "ping") } func (self *SHost) PerformPing(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2423,7 +2433,7 @@ func (self *SHost) AllowPerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "prepare") } func (self *SHost) PerformPrepare(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2459,7 +2469,7 @@ func (self *SHost) AllowPerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "add-netif") } func (self *SHost) PerformAddNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2620,7 +2630,7 @@ func (self *SHost) AllowPerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "enable-netif") } func (self *SHost) PerformEnableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2694,7 +2704,7 @@ func (self *SHost) AllowPerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "disable-netif") } func (self *SHost) PerformDisableNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2748,7 +2758,7 @@ func (self *SHost) AllowPerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "remove-netif") } func (self *SHost) PerformRemoveNetif(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2802,7 +2812,7 @@ func (self *SHost) AllowPerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "syncstatus") } func (self *SHost) PerformSyncstatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2814,7 +2824,7 @@ func (self *SHost) AllowPerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "reset") } func (self *SHost) PerformReset(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2844,7 +2854,7 @@ func (self *SHost) AllowPerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "remove-all-netifs") } func (self *SHost) PerformRemoveAllNetifs(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2861,7 +2871,7 @@ func (self *SHost) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "disable") } func (self *SHost) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2884,7 +2894,7 @@ func (self *SHost) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "cache-image") } func (self *SHost) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -2916,7 +2926,7 @@ func (self *SHost) AllowPerformConvertHypervisor(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "convert-hypervisor") } func (self *SHost) isAlterNameUnique(name string) bool { @@ -2982,7 +2992,7 @@ func (self *SHost) AllowPerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "undo-convert") } func (self *SHost) PerformUndoConvert(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/inframanagers.go b/pkg/compute/models/inframanagers.go deleted file mode 100644 index 962f752369..0000000000 --- a/pkg/compute/models/inframanagers.go +++ /dev/null @@ -1,33 +0,0 @@ -package models - -import ( - "context" - "yunion.io/x/jsonutils" - "yunion.io/x/onecloud/pkg/mcclient" -) - -type SInfrastructureManager struct { -} - -type SInfrastructure struct { -} - -func (self *SInfrastructureManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() -} - -func (self *SInfrastructureManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() -} - -func (self *SInfrastructure) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() -} - -func (self *SInfrastructure) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return userCred.IsSystemAdmin() -} - -func (self *SInfrastructure) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() -} diff --git a/pkg/compute/models/isolated_devices.go b/pkg/compute/models/isolated_devices.go index 0c30205d36..7a9a8738de 100644 --- a/pkg/compute/models/isolated_devices.go +++ b/pkg/compute/models/isolated_devices.go @@ -80,7 +80,7 @@ type SIsolatedDevice struct { func (manager *SIsolatedDeviceManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { host, _ := query.GetString("host") - if len(host) > 0 && !userCred.IsSystemAdmin() { + if len(host) > 0 && !db.IsAdminAllowList(userCred, manager) { return false } return true @@ -92,7 +92,7 @@ func (manager *SIsolatedDeviceManager) ExtraSearchConditions(ctx context.Context } func (manager *SIsolatedDeviceManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowCreate(userCred, manager) } func (manager *SIsolatedDeviceManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { diff --git a/pkg/compute/models/keypairs.go b/pkg/compute/models/keypairs.go index 687a21243f..e4bc4f3f77 100644 --- a/pkg/compute/models/keypairs.go +++ b/pkg/compute/models/keypairs.go @@ -47,7 +47,7 @@ func (manager *SKeypairManager) ListItemFilter(ctx context.Context, q *sqlchemy. if err != nil { return nil, err } - if userCred.IsSystemAdmin() && jsonutils.QueryBoolean(query, "admin", false) { + if jsonutils.QueryBoolean(query, "admin", false) && db.IsAdminAllowList(userCred, manager) { user, _ := query.GetString("user") if len(user) > 0 { uc, _ := db.UserCacheManager.FetchUserByIdOrName(user) @@ -71,7 +71,7 @@ func (self *SKeypair) IsOwner(userCred mcclient.TokenCredential) bool { } func (self *SKeypair) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsSystemAdmin() + return self.IsOwner(userCred) || db.IsAdminAllowGet(userCred, self) } func (self *SKeypair) GetCustomizeColumns(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) *jsonutils.JSONDict { @@ -85,7 +85,7 @@ func (self *SKeypair) GetExtraDetails(ctx context.Context, userCred mcclient.Tok extra := self.SStandaloneResourceBase.GetExtraDetails(ctx, userCred, query) extra.Add(jsonutils.NewInt(int64(len(self.PrivateKey))), "private_key_len") extra.Add(jsonutils.NewInt(int64(self.GetLinkedGuestsCount())), "linked_guest_count") - if userCred.IsSystemAdmin() { + if db.IsAdminAllowGet(userCred, self) { extra.Add(jsonutils.NewString(self.OwnerId), "owner_id") uc, _ := db.UserCacheManager.FetchUserById(self.OwnerId) if uc != nil { @@ -100,11 +100,11 @@ func (manager *SKeypairManager) AllowCreateItem(ctx context.Context, userCred mc } func (self *SKeypair) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, self) } func (self *SKeypair) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) || userCred.IsSystemAdmin() + return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } func (self *SKeypair) GetLinkedGuestsCount() int { diff --git a/pkg/compute/models/loadbalanceracls.go b/pkg/compute/models/loadbalanceracls.go index 94fd544b2a..17b0511f77 100644 --- a/pkg/compute/models/loadbalanceracls.go +++ b/pkg/compute/models/loadbalanceracls.go @@ -136,7 +136,7 @@ func (lbacl *SLoadbalancerAcl) ValidateUpdateData(ctx context.Context, userCred } func (lbacl *SLoadbalancerAcl) AllowPerformPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return lbacl.IsOwner(userCred) || userCred.IsSystemAdmin() + return lbacl.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lbacl, "patch") } // PerformPatch patches acl entries by adding then deleting the specified acls. diff --git a/pkg/compute/models/loadbalanceragents.go b/pkg/compute/models/loadbalanceragents.go index 29269063fd..11cd9154f1 100644 --- a/pkg/compute/models/loadbalanceragents.go +++ b/pkg/compute/models/loadbalanceragents.go @@ -20,7 +20,6 @@ import ( type SLoadbalancerAgentManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var LoadbalancerAgentManager *SLoadbalancerAgentManager @@ -46,7 +45,6 @@ func init() { // type SLoadbalancerAgent struct { db.SStandaloneResourceBase - SInfrastructure HbLastSeen time.Time `nullable:"true" list:"admin" update:"admin"` HbTimeout int `nullable:"true" list:"admin" update:"admin" create:"optional" default:"3600"` @@ -237,6 +235,27 @@ func (p *SLoadbalancerAgentParams) IsZero() bool { return false } + +func (self *SLoadbalancerAgentManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SLoadbalancerAgent) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SLoadbalancerAgent) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SLoadbalancerAgent) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (man *SLoadbalancerAgentManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { { keyV := map[string]validators.IValidator{ @@ -353,10 +372,6 @@ func (man *SLoadbalancerAgentManager) CleanPendingDeleteLoadbalancers(ctx contex } } -func (man *SLoadbalancerAgentManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() -} - func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { { keyV := map[string]validators.IValidator{ @@ -400,7 +415,7 @@ func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userC } func (lbagent *SLoadbalancerAgent) AllowPerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, lbagent, "hb") } func (lbagent *SLoadbalancerAgent) PerformHb(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -426,7 +441,7 @@ func (lbagent *SLoadbalancerAgent) IsActive() bool { } func (lbagent *SLoadbalancerAgent) AllowPerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, lbagent, "params-patch") } func (lbagent *SLoadbalancerAgent) PerformParamsPatch(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerbackends.go b/pkg/compute/models/loadbalancerbackends.go index f82dcc65cc..4eb5dcba9d 100644 --- a/pkg/compute/models/loadbalancerbackends.go +++ b/pkg/compute/models/loadbalancerbackends.go @@ -137,7 +137,7 @@ func (man *SLoadbalancerBackendManager) ValidateCreateData(ctx context.Context, } baseName = guest.Name case LB_BACKEND_HOST: - if !userCred.IsSystemAdmin() { + if !db.IsAdminAllowCreate(userCred, man) { return nil, fmt.Errorf("only sysadmin can specify host as backend") } backendV := validators.NewModelIdOrNameValidator("backend", "host", userCred.GetProjectId()) diff --git a/pkg/compute/models/loadbalancerlistenerrules.go b/pkg/compute/models/loadbalancerlistenerrules.go index 71be2e4b89..3e3d3bccc8 100644 --- a/pkg/compute/models/loadbalancerlistenerrules.go +++ b/pkg/compute/models/loadbalancerlistenerrules.go @@ -126,7 +126,7 @@ func (man *SLoadbalancerListenerRuleManager) ValidateCreateData(ctx context.Cont } func (lbr *SLoadbalancerListenerRule) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lbr.IsOwner(userCred) || userCred.IsSystemAdmin() + return lbr.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lbr, "status") } func (lbr *SLoadbalancerListenerRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancerlisteners.go b/pkg/compute/models/loadbalancerlisteners.go index 7ce180e9c1..ea16d3e9a4 100644 --- a/pkg/compute/models/loadbalancerlisteners.go +++ b/pkg/compute/models/loadbalancerlisteners.go @@ -295,7 +295,7 @@ func (man *SLoadbalancerListenerManager) validateAcl(aclStatusV *validators.Vali } func (lblis *SLoadbalancerListener) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lblis.IsOwner(userCred) || userCred.IsSystemAdmin() + return lblis.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lblis, "status") } func (lblis *SLoadbalancerListener) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { diff --git a/pkg/compute/models/loadbalancers.go b/pkg/compute/models/loadbalancers.go index 787a4b3159..c77e689677 100644 --- a/pkg/compute/models/loadbalancers.go +++ b/pkg/compute/models/loadbalancers.go @@ -132,7 +132,7 @@ func (man *SLoadbalancerManager) ValidateCreateData(ctx context.Context, userCre } func (lb *SLoadbalancer) AllowPerformStatus(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return lb.IsOwner(userCred) || userCred.IsSystemAdmin() + return lb.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, lb, "status") } func (lb *SLoadbalancer) PostCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) { diff --git a/pkg/compute/models/networks.go b/pkg/compute/models/networks.go index d8521bd574..a2c6d829db 100644 --- a/pkg/compute/models/networks.go +++ b/pkg/compute/models/networks.go @@ -134,7 +134,7 @@ func (self *SNetwork) GetVpc() *SVpc { } func (manager *SNetworkManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowCreate(userCred, manager) } func (self *SNetwork) ValidateDeleteCondition(ctx context.Context) error { @@ -627,7 +627,7 @@ func (manager *SNetworkManager) allNetworksQ(rangeObj db.IStandaloneModel) *sqlc func (manager *SNetworkManager) totalPortCountQ(userCred mcclient.TokenCredential, rangeObj db.IStandaloneModel) *sqlchemy.SQuery { q := manager.allNetworksQ(rangeObj) networks := manager.Query().SubQuery() - if userCred != nil && !userCred.IsSystemAdmin() { + if userCred != nil && !db.IsAdminAllowList(userCred, manager) { q = q.Filter(sqlchemy.OR( sqlchemy.Equals(networks.Field("tenant_id"), userCred.GetProjectId()), sqlchemy.IsTrue(networks.Field("is_public")))) @@ -759,7 +759,8 @@ func isValidNetworkInfo(userCred mcclient.TokenCredential, netConfig *SNetworkCo return httperrors.NewInputParameterError("Address %s not in range", netConfig.Address) } if netConfig.Reserved { - if !userCred.IsSystemAdmin() { + // the privilege to access reserved ip + if !db.IsAdminAllowList(userCred, ReservedipManager) { return httperrors.NewForbiddenError("Only system admin allowed to use reserved ip") } if ReservedipManager.GetReservedIP(net, netConfig.Address) == nil { @@ -876,7 +877,7 @@ func (self *SNetwork) GetCustomizeColumns(ctx context.Context, userCred mcclient } func (self *SNetwork) AllowPerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "reserve-ip") } func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -903,7 +904,7 @@ func (self *SNetwork) PerformReserveIp(ctx context.Context, userCred mcclient.To } func (self *SNetwork) AllowPerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "release-reserved-ip") } func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -920,7 +921,7 @@ func (self *SNetwork) PerformReleaseReservedIp(ctx context.Context, userCred mcc } func (self *SNetwork) AllowGetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowGetSpec(userCred, self, "reserved-ips") } func (self *SNetwork) GetDetailsReservedIps(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -1211,7 +1212,7 @@ func isOverlapNetworks(nets []SNetwork, startIp netutils.IPV4Addr, endIp netutil } func (self *SNetwork) CustomizeCreate(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data jsonutils.JSONObject) error { - if userCred.IsSystemAdmin() && ownerProjId == userCred.GetProjectId() { + if db.IsAdminAllowCreate(userCred, self.GetModelManager()) && ownerProjId == userCred.GetProjectId() { self.IsPublic = true } else { self.IsPublic = false @@ -1396,7 +1397,7 @@ func (self *SNetwork) ValidateUpdateCondition(ctx context.Context) error { } func (self *SNetwork) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SNetwork) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/reservedips.go b/pkg/compute/models/reservedips.go index d743ced163..67da0dc345 100644 --- a/pkg/compute/models/reservedips.go +++ b/pkg/compute/models/reservedips.go @@ -38,7 +38,7 @@ type SReservedip struct { } func (manager *SReservedipManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowList(userCred, manager) } func (manager *SReservedipManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { diff --git a/pkg/compute/models/routetables.go b/pkg/compute/models/routetables.go index eb8144fff7..e2abf06fde 100644 --- a/pkg/compute/models/routetables.go +++ b/pkg/compute/models/routetables.go @@ -159,7 +159,7 @@ func (rt *SRouteTable) ValidateUpdateData(ctx context.Context, userCred mcclient } func (rt *SRouteTable) AllowPerformAddRoutes(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { - return rt.IsOwner(userCred) || userCred.IsSystemAdmin() + return rt.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, rt, "add-routes") } func (rt *SRouteTable) AllowPerformDelRoutes(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) bool { diff --git a/pkg/compute/models/schedpolicies.go b/pkg/compute/models/schedpolicies.go index 185f932e6b..e4a54dafef 100644 --- a/pkg/compute/models/schedpolicies.go +++ b/pkg/compute/models/schedpolicies.go @@ -16,7 +16,6 @@ import ( type SSchedpolicyManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var SchedpolicyManager *SSchedpolicyManager @@ -35,7 +34,6 @@ func init() { // sched policy is called before calling scheduler, add additional preferences for schedtags type SSchedpolicy struct { db.SStandaloneResourceBase - SInfrastructure Condition string `width:"256" charset:"ascii" nullable:"false" list:"user" create:"required" update:"user"` SchedtagId string `width:"36" charset:"ascii" nullable:"false" list:"user" create:"required" update:"user"` @@ -62,6 +60,26 @@ func validateSchedpolicyInputData(data *jsonutils.JSONDict, create bool) error { return nil } +func (self *SSchedpolicyManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SSchedpolicyManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SSchedpolicy) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SSchedpolicy) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SSchedpolicy) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (manager *SSchedpolicyManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { err := validateSchedpolicyInputData(data, true) if err != nil { @@ -121,7 +139,7 @@ func (manager *SSchedpolicyManager) getAllEnabledPolicies() []SSchedpolicy { } func (self *SSchedpolicy) AllowPerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "evaluate") } func (self *SSchedpolicy) PerformEvaluate(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/schedtags.go b/pkg/compute/models/schedtags.go index 2c06f65eb8..b4605d7e9a 100644 --- a/pkg/compute/models/schedtags.go +++ b/pkg/compute/models/schedtags.go @@ -30,7 +30,6 @@ var STRATEGY_LIST = []string{STRATEGY_REQUIRE, STRATEGY_EXCLUDE, STRATEGY_PREFER type SSchedtagManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var SchedtagManager *SSchedtagManager @@ -48,7 +47,6 @@ func init() { type SSchedtag struct { db.SStandaloneResourceBase - SInfrastructure DefaultStrategy string `width:"16" charset:"ascii" nullable:"true" default:"" list:"user" update:"admin" create:"admin_optional"` // Column(VARCHAR(16, charset='ascii'), nullable=True, default='') } @@ -61,6 +59,18 @@ func (self *SSchedtag) AllowGetDetails(ctx context.Context, userCred mcclient.To return true } +func (self *SSchedtagManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SSchedtag) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SSchedtag) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (manager *SSchedtagManager) ValidateSchedtags(userCred mcclient.TokenCredential, schedtags map[string]string) (map[string]string, error) { ret := make(map[string]string) for tag, act := range schedtags { diff --git a/pkg/compute/models/secgrouprules.go b/pkg/compute/models/secgrouprules.go index 228a2dcfdc..a4792b9723 100644 --- a/pkg/compute/models/secgrouprules.go +++ b/pkg/compute/models/secgrouprules.go @@ -78,14 +78,14 @@ func (manager *SSecurityGroupRuleManager) AllowListItems(ctx context.Context, us func (self *SSecurityGroupRule) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) + return secgroup.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, self) } return false } func (self *SSecurityGroupRule) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { if secgroup := self.GetSecGroup(); secgroup != nil { - return secgroup.IsOwner(userCred) + return secgroup.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } return false } @@ -201,7 +201,7 @@ func (manager *SSecurityGroupRuleManager) ValidateCreateData(ctx context.Context if err != nil { return nil, httperrors.NewInputParameterError(err.Error()) } - return manager.SModelBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) + return manager.SResourceBaseManager.ValidateCreateData(ctx, userCred, ownerProjId, query, data) } func (self *SSecurityGroupRule) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -280,6 +280,10 @@ func (self *SSecurityGroupRule) String() string { return fields[0] + strings.Join(fields[1:], " ") } +func (self *SSecurityGroupRule) toRule() (*secrules.SecurityRule, error) { + return secrules.ParseSecurityRule(self.String()) +} + func (self *SSecurityGroupRule) SingleRules() ([]secrules.SecurityRule, error) { rules := make([]secrules.SecurityRule, 0) ruleStr := self.String() diff --git a/pkg/compute/models/secgroups.go b/pkg/compute/models/secgroups.go index 95f0d7d514..f03e2f4b82 100644 --- a/pkg/compute/models/secgroups.go +++ b/pkg/compute/models/secgroups.go @@ -124,11 +124,13 @@ func (self *SSecurityGroup) getSecurityRules(direction string) (rules []SSecurit func (self *SSecurityGroup) getSecRules(direction string) []secrules.SecurityRule { rules := make([]secrules.SecurityRule, 0) for _, _rule := range self.getSecurityRules(direction) { - singleRules, err := _rule.SingleRules() + //这里没必要拆分为单个单个的端口,到公有云那边适配 + rule, err := _rule.toRule() if err != nil { log.Errorf(err.Error()) + continue } - rules = append(rules, singleRules...) + rules = append(rules, *rule) } return rules } diff --git a/pkg/compute/models/skus.go b/pkg/compute/models/skus.go index f7b3e7eccb..4c3972ee14 100644 --- a/pkg/compute/models/skus.go +++ b/pkg/compute/models/skus.go @@ -3,6 +3,7 @@ package models import ( "context" "database/sql" + "yunion.io/x/sqlchemy" "yunion.io/x/jsonutils" @@ -24,7 +25,6 @@ const ( type SServerSkuManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var ServerSkuManager *SServerSkuManager @@ -44,7 +44,6 @@ func init() { // SServerSku 实际对应的是instance type清单. 这里的Sku实际指的是instance type。 type SServerSku struct { db.SStandaloneResourceBase - SInfrastructure // SkuId string `width:"64" charset:"ascii" nullable:"false" list:"user" create:"admin_required"` // x2.large InstanceTypeFamily string `width:"32" charset:"ascii" nullable:"false" list:"user" create:"admin_optional" update:"admin"` // x2 diff --git a/pkg/compute/models/snapshots.go b/pkg/compute/models/snapshots.go index ea57780729..09e557f0c8 100644 --- a/pkg/compute/models/snapshots.go +++ b/pkg/compute/models/snapshots.go @@ -86,8 +86,8 @@ func ValidateSnapshotName(hypervisor, name, owner string) error { return nil } -func (self *SSnapshot) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return self.IsOwner(userCred) +func (self *SSnapshotManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return true } func (manager *SSnapshotManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { @@ -323,7 +323,7 @@ func (self *SSnapshotManager) CreateSnapshot(ctx context.Context, userCred mccli } func (self *SSnapshot) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, self) } func (self *SSnapshot) StartSnapshotDeleteTask(ctx context.Context, userCred mcclient.TokenCredential, reloadDisk bool, parentTaskId string) error { @@ -364,7 +364,7 @@ func (self *SSnapshot) CustomizeDelete(ctx context.Context, userCred mcclient.To } func (self *SSnapshot) AllowPerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return self.IsOwner(userCred) + return self.IsOwner(userCred) || db.IsAdminAllowPerform(userCred, self, "deleted") } func (self *SSnapshot) PerformDeleted(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -401,7 +401,7 @@ func (self *SSnapshotManager) GetConvertSnapshot(deleteSnapshot *SSnapshot) (*SS } func (self *SSnapshotManager) AllowPerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsAdmin() + return db.IsAdminAllowClassPerform(userCred, self, "delete-disk-snapshots") } func (self *SSnapshotManager) PerformDeleteDiskSnapshots(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -586,7 +586,7 @@ func (self *SSnapshot) GetISnapshotRegion() (cloudprovider.ICloudRegion, error) } func (self *SSnapshot) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SSnapshot) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storagecachedimages.go b/pkg/compute/models/storagecachedimages.go index a91cc895b1..a2aedb8b51 100644 --- a/pkg/compute/models/storagecachedimages.go +++ b/pkg/compute/models/storagecachedimages.go @@ -30,7 +30,6 @@ const ( type SStoragecachedimageManager struct { db.SJointResourceBaseManager - SInfrastructureManager } var StoragecachedimageManager *SStoragecachedimageManager @@ -52,7 +51,6 @@ func init() { type SStoragecachedimage struct { db.SJointResourceBase - SInfrastructure StoragecacheId string `width:"36" charset:"ascii" nullable:"false" list:"admin" create:"admin_required" key_index:"true"` CachedimageId string `width:"36" charset:"ascii" nullable:"false" list:"admin" create:"admin_required" key_index:"true"` @@ -73,6 +71,26 @@ func (joint *SStoragecachedimage) Slave() db.IStandaloneModel { return db.JointSlave(joint) } +func (self *SStoragecachedimageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SStoragecachedimageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SStoragecachedimage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SStoragecachedimage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SStoragecachedimage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (self *SStoragecachedimage) getStorageHostId() (string, error) { var s SStorage storage := StorageManager.Query() @@ -127,7 +145,7 @@ func (self *SStoragecachedimage) GetExtraDetails(ctx context.Context, userCred m } func (manager *SStoragecachedimageManager) AllowListDescendent(ctx context.Context, userCred mcclient.TokenCredential, model db.IStandaloneModel, query jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowList(userCred, manager) } func (self *SStoragecachedimage) GetCachedimage() *SCachedimage { diff --git a/pkg/compute/models/storagecaches.go b/pkg/compute/models/storagecaches.go index e873a29f33..3a708195be 100644 --- a/pkg/compute/models/storagecaches.go +++ b/pkg/compute/models/storagecaches.go @@ -20,7 +20,6 @@ import ( type SStoragecacheManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var StoragecacheManager *SStoragecacheManager @@ -38,12 +37,31 @@ func init() { type SStoragecache struct { db.SStandaloneResourceBase - SInfrastructure SManagedResourceBase Path string `width:"256" charset:"utf8" nullable:"true" list:"user" update:"admin" create:"admin_optional"` // = Column(VARCHAR(256, charset='utf8'), nullable=True) } +func (self *SStoragecacheManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SStoragecacheManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SStoragecache) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SStoragecache) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SStoragecache) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (self *SStoragecache) getStorages() []SStorage { storages := make([]SStorage, 0) q := StorageManager.Query().Equals("storagecache_id", self.Id) @@ -315,7 +333,7 @@ func (self *SStoragecache) ValidateDeleteCondition(ctx context.Context) error { } func (self *SStoragecache) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "uncache-image") } func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -352,7 +370,7 @@ func (self *SStoragecache) PerformUncacheImage(ctx context.Context, userCred mcc } func (self *SStoragecache) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "cache-image") } func (self *SStoragecache) PerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/storages.go b/pkg/compute/models/storages.go index bcd809a08d..3ecdb5433d 100644 --- a/pkg/compute/models/storages.go +++ b/pkg/compute/models/storages.go @@ -91,7 +91,6 @@ var ( type SStorageManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var StorageManager *SStorageManager @@ -109,7 +108,6 @@ func init() { type SStorage struct { db.SStandaloneResourceBase - SInfrastructure SManagedResourceBase Capacity int `nullable:"false" list:"admin" update:"admin" create:"admin_required"` // Column(Integer, nullable=False) # capacity of disk in MB @@ -131,6 +129,26 @@ func (manager *SStorageManager) GetContextManager() []db.IModelManager { return []db.IModelManager{ZoneManager, StoragecacheManager} } +func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return true +} + +func (self *SStorageManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SStorage) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SStorage) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SStorage) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (manager *SStorageManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { storageType, _ := data.GetString("storage_type") mediumType, _ := data.GetString("medium_type") @@ -321,7 +339,7 @@ func (self *SStorage) SetStatus(userCred mcclient.TokenCredential, status string } func (self *SStorage) AllowPerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "enable") } func (self *SStorage) PerformEnable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -340,7 +358,7 @@ func (self *SStorage) PerformEnable(ctx context.Context, userCred mcclient.Token } func (self *SStorage) AllowPerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "disable") } func (self *SStorage) PerformDisable(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -359,7 +377,7 @@ func (self *SStorage) PerformDisable(ctx context.Context, userCred mcclient.Toke } func (self *SStorage) AllowPerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "online") } func (self *SStorage) PerformOnline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -374,7 +392,7 @@ func (self *SStorage) PerformOnline(ctx context.Context, userCred mcclient.Token } func (self *SStorage) AllowPerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "offline") } func (self *SStorage) PerformOffline(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { @@ -404,10 +422,6 @@ func (self *SStorage) IsLocal() bool { return self.StorageType == STORAGE_LOCAL || self.StorageType == STORAGE_BAREMETAL } -func (manager *SStorageManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return true -} - func (self *SStorage) GetStorageCachePath(mountPoint, imageCachePath string) string { if self.StorageType == STORAGE_NFS { return path.Join(mountPoint, imageCachePath) @@ -933,7 +947,7 @@ func (self *SStorage) SetStoragecache(cache *SStoragecache) error { } func (self *SStorage) AllowPerformCacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "cache-image") } func (self *SStorage) GetStoragecache() *SStoragecache { @@ -955,7 +969,7 @@ func (self *SStorage) PerformCacheImage(ctx context.Context, userCred mcclient.T } func (self *SStorage) AllowPerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "uncache-image") } func (self *SStorage) PerformUncacheImage(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/vcenters.go b/pkg/compute/models/vcenters.go index 79b298ccb2..f4ebc43687 100644 --- a/pkg/compute/models/vcenters.go +++ b/pkg/compute/models/vcenters.go @@ -11,7 +11,6 @@ import ( type SVCenterManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var VCenterManager *SVCenterManager @@ -29,7 +28,6 @@ func init() { type SVCenter struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure Hostname string `width:"64" charset:"ascii" nullable:"false" list:"admin"` // = Column(VARCHAR(64, charset='ascii'), nullable=False) Port int `nullable:"false" list:"admin"` // = Column(Integer, nullable=False) diff --git a/pkg/compute/models/vpcs.go b/pkg/compute/models/vpcs.go index 19672f747d..4d8cda4e93 100644 --- a/pkg/compute/models/vpcs.go +++ b/pkg/compute/models/vpcs.go @@ -35,7 +35,6 @@ const ( type SVpcManager struct { db.SEnabledStatusStandaloneResourceBaseManager - SInfrastructureManager } var VpcManager *SVpcManager @@ -53,7 +52,6 @@ func init() { type SVpc struct { db.SEnabledStatusStandaloneResourceBase - SInfrastructure SManagedResourceBase IsDefault bool `default:"false" list:"admin" create:"admin_optional"` @@ -67,6 +65,26 @@ func (manager *SVpcManager) GetContextManager() []db.IModelManager { return []db.IModelManager{CloudregionManager} } +func (self *SVpcManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SVpcManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SVpc) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SVpc) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SVpc) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (self *SVpc) GetCloudRegionId() string { if len(self.CloudregionId) == 0 { return DEFAULT_REGION_ID @@ -479,7 +497,7 @@ func (self *SVpc) getIPRange() netutils.IPV4AddrRange { } func (self *SVpc) AllowPerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return userCred.IsSystemAdmin() + return db.IsAdminAllowPerform(userCred, self, "purge") } func (self *SVpc) PerformPurge(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) { diff --git a/pkg/compute/models/wires.go b/pkg/compute/models/wires.go index 61d1da68e3..9d9cc82dec 100644 --- a/pkg/compute/models/wires.go +++ b/pkg/compute/models/wires.go @@ -19,7 +19,6 @@ import ( type SWireManager struct { db.SStandaloneResourceBaseManager - SInfrastructureManager } var WireManager *SWireManager @@ -39,7 +38,6 @@ func init() { type SWire struct { db.SStandaloneResourceBase - SInfrastructure Bandwidth int `list:"admin" update:"admin" nullable:"false" create:"admin_required"` // = Column(Integer, nullable=False) # bandwidth of network in Mbps ScheduleRank int `list:"admin" update:"admin"` // = Column(Integer, default=0, nullable=True) @@ -51,6 +49,26 @@ func (manager *SWireManager) GetContextManager() []db.IModelManager { return []db.IModelManager{ZoneManager, VpcManager} } +func (self *SWireManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowList(userCred, self) +} + +func (self *SWireManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SWire) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SWire) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SWire) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (manager *SWireManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { bandwidth, err := data.Int("bandwidth") if err != nil || bandwidth == 0 { diff --git a/pkg/compute/models/zones.go b/pkg/compute/models/zones.go index a58a5279d8..0120816f09 100644 --- a/pkg/compute/models/zones.go +++ b/pkg/compute/models/zones.go @@ -23,7 +23,6 @@ const ( type SZoneManager struct { db.SStatusStandaloneResourceBaseManager - SInfrastructureManager } var ZoneManager *SZoneManager @@ -42,7 +41,6 @@ func init() { type SZone struct { db.SStatusStandaloneResourceBase - SInfrastructure Location string `width:"256" charset:"utf8" get:"user" update:"admin"` // = Column(VARCHAR(256, charset='utf8')) Contacts string `width:"256" charset:"utf8" get:"user" update:"admin"` // = Column(VARCHAR(256, charset='utf8')) @@ -57,6 +55,22 @@ func (manager *SZoneManager) GetContextManager() []db.IModelManager { return []db.IModelManager{CloudregionManager} } +func (self *SZoneManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowCreate(userCred, self) +} + +func (self *SZone) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { + return db.IsAdminAllowGet(userCred, self) +} + +func (self *SZone) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { + return db.IsAdminAllowUpdate(userCred, self) +} + +func (self *SZone) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { + return db.IsAdminAllowDelete(userCred, self) +} + func (manager *SZoneManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { return true } diff --git a/pkg/compute/specs/handler.go b/pkg/compute/specs/handler.go index 2cf3b80d39..a7bc1a11b8 100644 --- a/pkg/compute/specs/handler.go +++ b/pkg/compute/specs/handler.go @@ -12,6 +12,7 @@ import ( "yunion.io/x/onecloud/pkg/appctx" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/compute/models" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" @@ -42,7 +43,7 @@ func AddSpecHandler(prefix string, app *appsrv.Application) { func processFilter(handleFunc specHandleFunc) appsrv.FilterHandler { return func(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) query, err := jsonutils.ParseQueryString(r.URL.RawQuery) if err != nil { httperrors.GeneralServerError(w, err) diff --git a/pkg/compute/sshkeys/handler.go b/pkg/compute/sshkeys/handler.go index f6bda5d2cf..85f8777933 100644 --- a/pkg/compute/sshkeys/handler.go +++ b/pkg/compute/sshkeys/handler.go @@ -9,7 +9,9 @@ import ( "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/appctx" "yunion.io/x/onecloud/pkg/appsrv" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" "yunion.io/x/onecloud/pkg/cloudcommon/db" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" "yunion.io/x/onecloud/pkg/httperrors" "yunion.io/x/onecloud/pkg/mcclient" "yunion.io/x/onecloud/pkg/mcclient/auth" @@ -22,8 +24,8 @@ func AddSshKeysHandler(prefix string, app *appsrv.Application) { func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) { publicOnly := false - userCred := auth.FetchUserCredential(ctx) - if !userCred.IsSystemAdmin() { + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) + if !userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) { publicOnly = true } params := appctx.AppContextParams(ctx) @@ -53,7 +55,7 @@ func adminSshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Req } func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) query, err := jsonutils.ParseQueryString(r.URL.RawQuery) if err != nil { httperrors.GeneralServerError(w, err) @@ -67,7 +69,7 @@ func sshKeysHandler(ctx context.Context, w http.ResponseWriter, r *http.Request) func sendSshKey(ctx context.Context, w http.ResponseWriter, userCred mcclient.TokenCredential, projectId string, isAdmin bool, publicOnly bool) { var privKey, pubKey string - if isAdmin && userCred.IsSystemAdmin() { + if isAdmin && userCred.IsAdminAllow(consts.GetServiceType(), "sshkeypairs", policy.PolicyActionGet) { privKey, pubKey, _ = GetSshAdminKeypair(ctx) } else { privKey, pubKey, _ = GetSshProjectKeypair(ctx, projectId) diff --git a/pkg/compute/tasks/eip_associate_task.go b/pkg/compute/tasks/eip_associate_task.go index fba01a4efc..483fb0f686 100644 --- a/pkg/compute/tasks/eip_associate_task.go +++ b/pkg/compute/tasks/eip_associate_task.go @@ -20,10 +20,10 @@ func init() { } func (self *EipAssociateTask) TaskFail(ctx context.Context, eip *models.SElasticip, msg string, vm *models.SGuest) { - eip.SetStatus(self.UserCred, models.EIP_STATUS_ASSOCIATE_FAIL, msg) + eip.SetStatus(self.UserCred, models.EIP_STATUS_READY, msg) self.SetStageFailed(ctx, msg) if vm != nil { - vm.StartSyncstatus(ctx, self.UserCred, "") + vm.SetStatus(self.UserCred, models.VM_ASSOCIATE_EIP_FAILED, msg) } } diff --git a/pkg/compute/tasks/eip_dissociate_task.go b/pkg/compute/tasks/eip_dissociate_task.go index 39390d458b..f91d7569eb 100644 --- a/pkg/compute/tasks/eip_dissociate_task.go +++ b/pkg/compute/tasks/eip_dissociate_task.go @@ -20,10 +20,10 @@ func init() { } func (self *EipDissociateTask) TaskFail(ctx context.Context, eip *models.SElasticip, msg string, vm *models.SGuest) { - eip.SetStatus(self.UserCred, models.EIP_STATUS_DISSOCIATE_FAIL, msg) + eip.SetStatus(self.UserCred, models.EIP_STATUS_READY, msg) self.SetStageFailed(ctx, msg) if vm != nil { - vm.StartSyncstatus(ctx, self.UserCred, "") + vm.SetStatus(self.UserCred, models.VM_DISSOCIATE_EIP_FAILED, msg) } } diff --git a/pkg/compute/usages/handler.go b/pkg/compute/usages/handler.go index 7a32ccfddd..edd4300612 100644 --- a/pkg/compute/usages/handler.go +++ b/pkg/compute/usages/handler.go @@ -75,7 +75,7 @@ func rangeObjHandler( reporter objUsageFunc, ) appsrv.FilterHandler { return func(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) obj, err := getRangeObj(ctx, manager, userCred) if err != nil { httperrors.NotFoundError(w, err.Error()) @@ -276,7 +276,7 @@ func ReportGeneralUsage(userCred mcclient.TokenCredential, rangeObj db.IStandalo isAdmin = true } } else { - isAdmin = userCred.IsSystemAdmin() + isAdmin = userCred.IsAdminAllow(consts.GetServiceType(), "usages", policy.PolicyActionGet) } if isAdmin { diff --git a/pkg/mcclient/auth/middleware.go b/pkg/mcclient/auth/middleware.go index fa14ac898c..5c892a33ce 100644 --- a/pkg/mcclient/auth/middleware.go +++ b/pkg/mcclient/auth/middleware.go @@ -53,10 +53,14 @@ func AuthenticateWithDelayDecision(f appsrv.FilterHandler, delayDecision bool) a } } -func FetchUserCredential(ctx context.Context) mcclient.TokenCredential { +func FetchUserCredential(ctx context.Context, filter func(mcclient.TokenCredential) mcclient.TokenCredential) mcclient.TokenCredential { tokenValue := ctx.Value(AUTH_TOKEN) if tokenValue != nil { - return tokenValue.(mcclient.TokenCredential) + token := tokenValue.(mcclient.TokenCredential) + if filter != nil { + token = filter(token) + } + return token } return nil } diff --git a/pkg/mcclient/modules/base.go b/pkg/mcclient/modules/base.go index 3a71f43eac..97becef66b 100644 --- a/pkg/mcclient/modules/base.go +++ b/pkg/mcclient/modules/base.go @@ -32,7 +32,7 @@ func NewBaseManager(serviceType, endpointType, version string, columns, adminCol func (this *BaseManager) GetColumns(session *mcclient.ClientSession) []string { cols := this.columns - if session.IsSystemAdmin() && len(this.adminColumns) > 0 { + if session.HasSystemAdminPrivelege() && len(this.adminColumns) > 0 { cols = append(cols, this.adminColumns...) } return cols diff --git a/pkg/mcclient/options/k8s/release.go b/pkg/mcclient/options/k8s/release.go index d6714a8216..2663e6ee57 100644 --- a/pkg/mcclient/options/k8s/release.go +++ b/pkg/mcclient/options/k8s/release.go @@ -128,3 +128,33 @@ type ReleaseDeleteOptions struct { ClusterBaseOptions NAME string `help:"Release instance name"` } + +type ReleaseHistoryOptions struct { + ClusterBaseOptions + NAME string `help:"Release instance name"` + Max int64 `help:"History limit size"` +} + +func (o ReleaseHistoryOptions) Params() *jsonutils.JSONDict { + params := o.ClusterBaseOptions.Params() + if o.Max >= 1 { + params.Add(jsonutils.NewInt(o.Max), "max") + } + return params +} + +type ReleaseRollbackOptions struct { + ClusterBaseOptions + NAME string `help:"Release instance name"` + REVISION int64 `help:"Release history revision number"` + Description string `help:"Release rollback description string"` +} + +func (o ReleaseRollbackOptions) Params() *jsonutils.JSONDict { + params := o.ClusterBaseOptions.Params() + params.Add(jsonutils.NewInt(o.REVISION), "revision") + if o.Description != "" { + params.Add(jsonutils.NewString(o.Description), "description") + } + return params +} diff --git a/pkg/mcclient/session.go b/pkg/mcclient/session.go index 6d9d3cc019..2bbcaf57f9 100644 --- a/pkg/mcclient/session.go +++ b/pkg/mcclient/session.go @@ -9,7 +9,6 @@ import ( "regexp" "strings" "time" - "yunion.io/x/jsonutils" "yunion.io/x/onecloud/pkg/util/httputils" "yunion.io/x/pkg/utils" @@ -151,8 +150,8 @@ func (this *ClientSession) ParseJSONResponse(resp *http.Response, err error) (ht return httputils.ParseJSONResponse(resp, err, this.client.debug) } -func (this *ClientSession) IsSystemAdmin() bool { - return this.token.IsSystemAdmin() +func (this *ClientSession) HasSystemAdminPrivelege() bool { + return this.token.HasSystemAdminPrivelege() } func (this *ClientSession) GetRegion() string { diff --git a/pkg/mcclient/token.go b/pkg/mcclient/token.go index 6aef27acd7..a2a0ab7ad8 100644 --- a/pkg/mcclient/token.go +++ b/pkg/mcclient/token.go @@ -44,8 +44,9 @@ type TokenCredential interface { GetExpires() time.Time IsValid() bool ValidDuration() time.Duration - IsAdmin() bool - IsSystemAdmin() bool + // IsAdmin() bool + HasSystemAdminPrivelege() bool + IsAdminAllow(service string, resource string, action string, extra ...string) bool GetRegions() []string GetServiceCatalog() IServiceCatalog diff --git a/pkg/mcclient/token2.go b/pkg/mcclient/token2.go index f2a8eb8a43..f64d045014 100644 --- a/pkg/mcclient/token2.go +++ b/pkg/mcclient/token2.go @@ -130,10 +130,14 @@ func (this *TokenCredentialV2) GetRegions() []string { return this.ServiceCatalog.getRegions() } -func (this *TokenCredentialV2) IsSystemAdmin() bool { +func (this *TokenCredentialV2) HasSystemAdminPrivelege() bool { return this.IsAdmin() && this.GetTenantName() == "system" } +func (this *TokenCredentialV2) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + return this.HasSystemAdminPrivelege() +} + func (this *TokenCredentialV2) GetServiceURL(service, region, zone, endpointType string) (string, error) { return this.ServiceCatalog.GetServiceURL(service, region, zone, endpointType) } diff --git a/pkg/mcclient/token3.go b/pkg/mcclient/token3.go index bc172bf78d..38e962b119 100644 --- a/pkg/mcclient/token3.go +++ b/pkg/mcclient/token3.go @@ -135,10 +135,14 @@ func (this *TokenCredentialV3) IsAdmin() bool { return false } -func (this *TokenCredentialV3) IsSystemAdmin() bool { +func (this *TokenCredentialV3) HasSystemAdminPrivelege() bool { return this.IsAdmin() && this.GetTenantName() == "system" } +func (this *TokenCredentialV3) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + return this.HasSystemAdminPrivelege() +} + func (this *TokenCredentialV3) GetRegions() []string { return this.Token.Catalog.getRegions() } diff --git a/pkg/mcclient/tokensimple.go b/pkg/mcclient/tokensimple.go index f10c2b73fa..15a8badbfb 100644 --- a/pkg/mcclient/tokensimple.go +++ b/pkg/mcclient/tokensimple.go @@ -84,10 +84,14 @@ func (self *SSimpleToken) IsAdmin() bool { return false } -func (self *SSimpleToken) IsSystemAdmin() bool { +func (self *SSimpleToken) HasSystemAdminPrivelege() bool { return self.IsAdmin() && self.Project == "system" } +func (this *SSimpleToken) IsAdminAllow(service string, resource string, action string, extra ...string) bool { + return this.HasSystemAdminPrivelege() +} + func (self *SSimpleToken) GetRegions() []string { return nil } diff --git a/pkg/util/qcloud/disk.go b/pkg/util/qcloud/disk.go index 9c8ae72f19..2700068e37 100644 --- a/pkg/util/qcloud/disk.go +++ b/pkg/util/qcloud/disk.go @@ -179,7 +179,7 @@ func (self *SDisk) Resize(ctx context.Context, sizeMb int64) error { } func (self *SDisk) GetName() string { - if len(self.DiskName) > 0 { + if len(self.DiskName) > 0 && self.DiskName != "未命名" { return self.DiskName } return self.DiskId diff --git a/pkg/util/qcloud/instance.go b/pkg/util/qcloud/instance.go index eef98ab7f6..d2eb9137cd 100644 --- a/pkg/util/qcloud/instance.go +++ b/pkg/util/qcloud/instance.go @@ -165,7 +165,10 @@ func (self *SInstance) GetId() string { } func (self *SInstance) GetName() string { - return self.InstanceName + if len(self.InstanceName) > 0 && self.InstanceName != "未命名" { + return self.InstanceName + } + return self.InstanceId } func (self *SInstance) GetGlobalId() string { @@ -371,7 +374,7 @@ func (self *SInstance) GetVNCInfo() (jsonutils.JSONObject, error) { return nil, err } ret := jsonutils.NewDict() - ret.Add(jsonutils.NewString("https://img.qcloud.com/qcloud/app/active_vnc/index.html?InstanceVncUrl="+url), "url") + ret.Add(jsonutils.NewString(url), "url") ret.Add(jsonutils.NewString("qcloud"), "protocol") ret.Add(jsonutils.NewString(self.InstanceId), "instance_id") return ret, nil diff --git a/pkg/util/qcloud/securitygroup.go b/pkg/util/qcloud/securitygroup.go index 9e977adb8a..ad31faf336 100644 --- a/pkg/util/qcloud/securitygroup.go +++ b/pkg/util/qcloud/securitygroup.go @@ -264,8 +264,8 @@ func (self *SSecurityGroup) GetRules() ([]secrules.SecurityRule, error) { secgroup.SecurityGroupPolicySet.Ingress[i].direction = "in" } originRules := []SecurityGroupPolicy{} - originRules = append(secgroup.SecurityGroupPolicySet.Egress) - originRules = append(secgroup.SecurityGroupPolicySet.Ingress) + originRules = append(originRules, secgroup.SecurityGroupPolicySet.Egress...) + originRules = append(originRules, secgroup.SecurityGroupPolicySet.Ingress...) sort.Sort(SecurityGroupRuleSet(originRules)) rules := []secrules.SecurityRule{} priority := 100 diff --git a/pkg/webconsole/handlers.go b/pkg/webconsole/handlers.go index 2f0ed8c05a..67ed8f81f6 100644 --- a/pkg/webconsole/handlers.go +++ b/pkg/webconsole/handlers.go @@ -17,6 +17,7 @@ import ( "yunion.io/x/onecloud/pkg/webconsole/command" o "yunion.io/x/onecloud/pkg/webconsole/options" "yunion.io/x/onecloud/pkg/webconsole/session" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -102,7 +103,7 @@ type CloudEnv struct { func fetchCloudEnv(ctx context.Context, w http.ResponseWriter, r *http.Request) (*CloudEnv, error) { params, query, body := appsrv.FetchEnv(ctx, w, r) - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) if userCred == nil { return nil, httperrors.NewUnauthorizedError("No token founded") } @@ -141,7 +142,7 @@ func handleK8sLog(ctx context.Context, w http.ResponseWriter, r *http.Request) { } func handleSshShell(ctx context.Context, w http.ResponseWriter, r *http.Request) { - userCred := auth.FetchUserCredential(ctx) + userCred := auth.FetchUserCredential(ctx, policy.FilterPolicyCredential) env, err := fetchCloudEnv(ctx, w, r) if err != nil { httperrors.GeneralServerError(w, err) @@ -194,7 +195,7 @@ func handleServerRemoteConsole(ctx context.Context, w http.ResponseWriter, r *ht return } switch info.Protocol { - case session.ALIYUN: + case session.ALIYUN, session.QCLOUD: responsePublicCloudConsole(info, w) case session.VNC, session.SPICE, session.WMKS: handleDataSession(info, w) diff --git a/pkg/webconsole/service/service.go b/pkg/webconsole/service/service.go index d86ef761c4..cc89ee6122 100644 --- a/pkg/webconsole/service/service.go +++ b/pkg/webconsole/service/service.go @@ -15,6 +15,7 @@ import ( "yunion.io/x/onecloud/pkg/webconsole" o "yunion.io/x/onecloud/pkg/webconsole/options" "yunion.io/x/onecloud/pkg/webconsole/server" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" ) func ensureBinExists(binPath string) { @@ -24,6 +25,8 @@ func ensureBinExists(binPath string) { } func StartService() { + consts.SetServiceType("webconsole") + cloudcommon.ParseOptions(&o.Options, &o.Options.Options, os.Args, "webconsole.conf") if o.Options.ApiServer == "" { diff --git a/pkg/webconsole/session/remote_console.go b/pkg/webconsole/session/remote_console.go index ae211cc4ce..985d2a2fef 100644 --- a/pkg/webconsole/session/remote_console.go +++ b/pkg/webconsole/session/remote_console.go @@ -12,6 +12,7 @@ import ( const ( VNC = "vnc" ALIYUN = "aliyun" + QCLOUD = "qcloud" SPICE = "spice" WMKS = "wmks" ) @@ -74,10 +75,26 @@ func (info *RemoteConsoleInfo) ShowInfo() string { } func (info *RemoteConsoleInfo) GetConnectParams() (string, error) { - if info.Protocol != ALIYUN { - return "", fmt.Errorf("Can't convert protocol %s to connect params", info.Protocol) + if info.Protocol == ALIYUN { + return info.getAliyunUrl() } + if info.Protocol == QCLOUD { + return info.getQcloudUrl() + } + + return "", fmt.Errorf("Can't convert protocol %s to connect params", info.Protocol) +} + +func (info *RemoteConsoleInfo) getQcloudUrl() (string, error) { + base := "https://img.qcloud.com/qcloud/app/active_vnc/index.html" + params := url.Values{ + "InstanceVncUrl": {info.Url}, + } + return fmt.Sprintf("%s?%s", base, params.Encode()), nil +} + +func (info *RemoteConsoleInfo) getAliyunUrl() (string, error) { isWindows := "False" if info.OsName == "Windows" { isWindows = "True" diff --git a/pkg/yunionconf/models/parameters.go b/pkg/yunionconf/models/parameters.go index 9f3f56f97f..90f40903fa 100644 --- a/pkg/yunionconf/models/parameters.go +++ b/pkg/yunionconf/models/parameters.go @@ -11,6 +11,8 @@ import ( "yunion.io/x/pkg/util/timeutils" "yunion.io/x/pkg/utils" "yunion.io/x/sqlchemy" + "yunion.io/x/onecloud/pkg/cloudcommon/consts" + "yunion.io/x/onecloud/pkg/cloudcommon/policy" ) const ( @@ -72,7 +74,7 @@ func getNamespaceInContext(userCred mcclient.TokenCredential, query jsonutils.JS func getNamespace(userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (string, string, error) { var namespace, namespace_id string - if userCred.IsSystemAdmin() { + if db.IsAdminAllowGet(userCred, ParameterManager) { if name, nameId, e := getNamespaceInContext(userCred, query, data); e != nil { return "", "", e } else { @@ -92,7 +94,7 @@ func (manager *SParameterManager) AllowListItems(ctx context.Context, userCred m return true } - return userCred.IsSystemAdmin() + return db.IsAdminAllowList(userCred, manager) } func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { @@ -100,7 +102,7 @@ func (manager *SParameterManager) AllowCreateItem(ctx context.Context, userCred return true } - return userCred.IsSystemAdmin() + return db.IsAdminAllowCreate(userCred, manager) } func (manager *SParameterManager) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, ownerProjId string, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -146,7 +148,7 @@ func (manager *SParameterManager) FilterByName(q *sqlchemy.SQuery, name string) } func (manager *SParameterManager) ListItemFilter(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential, query jsonutils.JSONObject) (*sqlchemy.SQuery, error) { - if userCred.IsSystemAdmin() { + if db.IsAdminAllowList(userCred, manager) { if id, _ := query.GetString("namespace_id"); len(id) > 0 { q = q.Equals("namespace_id", id) } else if id, _ := query.GetString("service_id"); len(id) > 0 { @@ -171,7 +173,7 @@ func (model *SParameter) IsOwner(userCred mcclient.TokenCredential) bool { } func (model *SParameter) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool { - return model.IsOwner(userCred) || userCred.IsSystemAdmin() + return model.IsOwner(userCred) || db.IsAdminAllowUpdate(userCred, model) } func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) { @@ -191,7 +193,7 @@ func (model *SParameter) ValidateUpdateData(ctx context.Context, userCred mcclie } func (model *SParameter) AllowDeleteItem(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsSystemAdmin() + return model.IsOwner(userCred) || db.IsAdminAllowDelete(userCred, model) } func (model *SParameter) CustomizeDelete(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) error { @@ -211,5 +213,5 @@ func (model *SParameter) Delete(ctx context.Context, userCred mcclient.TokenCred } func (model *SParameter) AllowGetDetails(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool { - return model.IsOwner(userCred) || userCred.IsSystemAdmin() + return model.IsOwner(userCred) || db.IsAdminAllowGet(userCred, model) } diff --git a/pkg/yunionconf/service/service.go b/pkg/yunionconf/service/service.go index 8899ce3f1f..9520a5dfba 100644 --- a/pkg/yunionconf/service/service.go +++ b/pkg/yunionconf/service/service.go @@ -16,6 +16,8 @@ import ( ) func StartService() { + consts.SetServiceType("yunionconf") + cloudcommon.ParseOptions(&options.Options, &options.Options.Options, os.Args, "yunionconf.conf") cloudcommon.InitAuth(&options.Options.Options, func() { log.Infof("Auth complete!!")