Problem: When reinstalling a VM, the UI only shows featured templates and not all possible list of allowed templates.
Root Cause: The list of templates for reinstall used featured as filter in ‘listTemplates’ API which did not include all available options.
Solution: The issue is fixed by using the executable template filter of the ‘listTemplates’ API to list all
possible templates that a user is allowed to use to deploy a VM.
Hide multiselectaction buttons when selection is resetted after a action is performed
Use checked prop instead of attr to show/hide triggered selection when box was clicked by a user before.
How to reproduce:
Select one entry in a multiSelect listView (e.g. instance list) and then deselect it again. Now click on the "select all" checkbox. The entries which were clicked previously are not displayed as selected.
Select at least one entry. Use the multiSelectAction buttons to trigger an action. Wait for completion. The list refreshes and no entry is selected but the multiSelectAction buttons are displayed.
Fix:
Use "checked" property instead of the attribute to select all entries. This is necessary because when you checked an entry by clicking on it the property gets set and the browser is preferably using this. So setting the attribute by clicking on the "select all" checkbox had no impact anymore on the checkBox of the previously clicked entries.
Hide the multiSelectAction buttons when the list is refreshed after an action is performed and no element is selected anymore.
This removes CA certificate button from UI as this is not used and
confuses both admin and users how to use it. This may be re-introduced
in future when a use-case can be justified.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* Fix XenServer Security Groups 'vmops' script
- fix tokens = line.split(':') to tokens = line.split(';')
- fix expected tokens size from 5 to 4
- enhance logs
- remove unused vmops script. The XCP patch points to the vmops script
on the parent folder [1]. Thus, all XenServer versions are considering
the vmops script located at [2].
- fix UI ipv4/ipv6 cidr validator to allow a list of cidirs.
Fixing issue: #3192 Security Group rules not applied at all for
XenServer 6.5 / Advanced Zone
https://github.com/apache/cloudstack/issues/3192
* Update security group rules after VM migration
Add security group rules on target host
Cause: vmops script expected secondary IPs as "0;" but received "0:"
Remove security group network rules on source host.
Cause: destroy_network_rules_for_vm function on vmops script was not
called when migrating VM
* Add unit tests and address reviewers
* api: add command to list management servers
* api: add number of mangement servers in listInfrastructure command
* ui: add block for mangement servers on infra page
* api name resolution method cleanup
* Update jquery, jquery ui, jquery validate and flot to current versions
update jquery to 3.3.1
update jqueryui to 1.12.1
update jquery validate to 1.17.0
update jquery flot to 0.8.3
* Replace deprecated removed jquery functions
* Fix initial tab content loading in detailView
* Fix logout for new jquery version
* Fix tooltip detail displaying for new JQuery version
* Fix view all trigger in detailView for new JQuery version
* Fix breadcrumb click event handler for JQuery update
* Fix displaying of preselected zone in instanceWizard for new jQuery verion
* Remove redundant checkbox that controls the visibility of volumes to delete when destroying VMs
* Change label from Volume IDs to Delete Volumes
* Revert back deleted Volume IDs label
This PR adds the possibility to select a checkbox for the parameter bypassvlanoverlapcheck to the ajax request createNetwork. The checkbox was added for Guest Network as well as for the L2 Guest Network. For L2 Guest Network a backend check for the existence of the flag bypassvlanoverlapcheck was added.
## Description
Adds the MAC address to the NICs detail view of an instance.
## Types of changes
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Bug fix (non-breaking change which fixes an issue)
- [x] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
## Screenshots:
## How Has This Been Tested?
Tested locally to verify that the correct mac address gets displayed in the detail view.
This adds a new API updateVmwareDc that allows admins to update the
VMware datacenter details of a zone. It also recursively updates
the cluster_details for any username/password updates
as well as updates the url detail in cluster_details table and guid
detail in the host_details table with any newly provided vcenter
domain/ip. The update API assumes that there is only one vCenter per
zone. And, since the username/password for each VMware host could be different
than what gets configured for vcenter at zone level, it does not update the
username/password in host_details.
Previously, one has to manually update the db with any new vcenter details for the zone.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
When the “deleteDomain” command is sent via UI, the HTML is already updated assuming that the “deleteDomain” command will actually delete it. However, there are cases (domain with allocated resources) that will not allow ACS to remove the command; as a consequence, the UI will not be in sync with ACS state, which can lead to misunderstandings.
This update changes how the languages are shown on the UI's login page. Previously all languages were shown in the current language of the login page. This meant for instance, that a Japanese speaker would have to know English to find their language. Likewise if the language had been changed, a German speaker might need to speak Korean in order to find their language.
Therefore the UI has been altered to always show the name of each language in the appropriate language.
Fix UI overlay issue in snapshot view on master with new jquery and other changes. This problem was created because of the jQuery-UI upgrade.
This fixes: #2830
In the UI, when Setting up a recurring snapshot for a volume and clicking 'Add', the newly added scheduled snapshot entry is not displayed in the 'Scheduled Snapshots' table. Also, the 'Keep' input field does not limit the length of a number that can be added. This causes the API not return an error that the value is invalid.
After adding a recurring snapshot, it must display in the 'Scheduled Snapshots' table. The 'Keep' input field must restrain a user from entering too large of a number.
* 4.11:
Changed the implementation of isVolumeOnManagedStorage(VolumeInfo) to check if the data store in question is for primary storage (and added a unit test from Daan Hoogland)
vmware: reboot VR after mac updates (#2794)
This re-introduces the rebooting of VR after setup of nics/macs in
case of VMware. It also adds a minor enhancement to show the console
esp. for root admins when VRs and systemvms are in starting state.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
In the UI, when a VM instance has more than one NIC, the NICs screen does not display all the details of the first NIC. The last few rows of text overlap with the second NIC's text. This is due to the incorrect placement of the second NIC's bar. The default height sizing does not allow enough head space to display all the details of the first NIC before displaying the second NIC's details.
Expected Behaviour:
When a VM instance has more than one NIC, the NICs screen must allow enough height size to display all the details of the first NIC before displaying the second NIC's details. The last few rows of text must not overlap with the second NIC's text.
Current Behaviour:
When a VM instance has more than one NIC, the NICs screen does not allow enough height size to display all the details of the first NIC before displaying the second NIC's details. The last few rows of text overlap with the second NIC's text.
To Reproduce:
In the UI, on the lefthand side, select the Instances link. On the Instances screen, select a VM instance that has more than one NIC and then select the NICs screen. Scroll down to where the second NIC bar is displayed. Notice that it does not display all the details of the first NIC correctly. The last few rows of text overlap with the second NIC's text.
In the UI, when a user navigates to a screen that displays a table of data and hovers the mouse over a sortable column header, the cursor does not change to a hand pointer, indicating to the user that it can be clicked on, in order to sort the table's data rows according to that column.
When the mouse hovers over the non-sortable 'Quickview' column header, it incorrectly displays a hand pointer cursor instead of a default cursor.
When the mouse hovers over a column header, it also does not display the column header's value as a tooltip.
Expected Behaviour:
The cursor type for a sortable column header must display a hand pointer.
The cursor type for the non-sortable 'Quickview' column header must display a default pointer.
When the mouse hovers over a column header it must display the column header's value as a tooltip.
Actual Behaviour:
The cursor type for a sortable column header incorrectly displays a default pointer.
The cursor type for the non-sortable 'Quickview' column header incorrectly displays a hand pointer.
When the mouse hovers over a column header it does not display the column header's value as a tooltip.
To Reproduce:
In the UI, navigate to a screen that displays a table of data and hover the mouse over a sortable column header, the cursor does not change to a hand pointer.
Hover the mouse over the non-sortable 'Quickview' column header and notice that it incorrectly displays a hand pointer cursor instead of a default cursor.
Hover the mouse over a column header and notice that it does not display the column header's value as a tooltip.
When a regular user navigates to the Dashboard screen and hovers over the 'Latest events' entries, the mouse cursor changes to a hand pointer, but it cannot select any of these entries.
Expected Behaviour:
When a user navigates to the Dashboard screen and hovers over the 'Latest events' entries, the mouse cursor must not change to a hand pointer. This will allow the user to make the correct interpretation that the 'Latest events' entries are not selectable.
Actual Behaviour:
When a user navigates to the Dashboard screen and hovers over the 'Latest events' entries, the mouse cursor changes to a hand pointer. This causes a user to incorrectly interpret that the entries are selectable.
To Reproduce:
Log in to the Cloudstack UI as a regular User.
On the Dashboard screen, hover the mouse over the 'Latest events' entries, the cursor changes to a hand pointer. Confirm that the entries cannot be selected.
In the index.html file, the reference to the custom.css file is made on the last line of the <head> tag.
The plugins.js file appends a list of CSS files to the <head> tag dynamically, consequently placing them after the custom.css file and overriding it.
Expected Behaviour:
The plugins.js file must insert the list of CSS files before the custom.css file so that it does not get overridden.
Actual Behaviour:
The plugins.js file appends a list of CSS files to the <head> tag dynamically, consequently placing them after the custom.css file and overriding it.
To Reproduce:
Log in to the Cloudstack UI using your favourite browser.
Use your browser's development tool to view the HTML elements of the index.html loaded in memory.
Expand the <head> element and review the list of CSS <link> elements.
Notice that the list of module and plugins CSS files is appended after the custom.css file.
On the 'NICs' tab, when a user clicks the 'Add network to VM' button to add a network to a VM, the 'Add network to VM' popup screen does not have an IP Address input field to allow a user to define a specific IP Address for a NIC. A user can specify the IP address for the first NIC when creating a VM instance, but cannot do that for subsequent NICs when adding a network to a VM.
To Reproduce:
Go to the 'Instances' screen by clicking the 'Instances' tab on the lefthand side.
On the 'Instances' screen click on a specific VM instance name.
This will open the 'Details' tab for the specific VM instance.
Click on the 'NICs' tab and then click on the 'Add network to VM' button to add a network to a VM.
The 'Add network to VM' popup screen will display.
Actual Behaviour:
The 'Add network to VM' popup screen does not have an IP Address input field to allow a user to define a specific IP Address for a NIC.
Expected behaviour:
The 'Add network to VM' popup screen must have an IP Address input field to allow a user to define a specific IP Address for a NIC.
Since the addNicToVirtualMachine API's ipaddress field is not required, the IP Address input field is also not a required field.
The IP Address input field must be validated for a valid IPv4 formatted value if the user enters anything into the field.
The valid user-specified IPv4 IP Address value must be allocated to the NIC if it is within the acceptable IP range for the chosen Network.
On the 'Register Template From URL' screen, when a user selects the VMware option from the Hypervisor dropdown:
It incorrectly displays the 'HVM' checkbox.
This checkbox must be hidden in the VMware context.
This checkbox must still be visible in any other hypervisor context.
To Reproduce:
Go to the 'Register Template From URL' screen by clicking the 'Templates' tab on the lefthand side.
On the 'Templates' screen click the 'Add' button to display the 'Register Template From URL' screen.
On the 'Register Template From URL' screen, select the VMware option from the Hypervisor dropdown:
Actual Behaviour:
It incorrectly displays the 'HVM' checkbox.
Expected behaviour:
This checkbox must be hidden in the VMware context.
This checkbox must still be visible in any other hypervisor context.
In the UI, on the Instances screen, the Quickview popup window and the Details window do not display the 'Reset SSH Key Pair' button for VMs in a running state. They only display when the VM is in a stopped state. This is inconsistent with the 'Reset Password' button behaviour, where it displays in both VM states: running and stopped. This fixes the issue so that the 'Reset SSH Key Pair' button also displays in both VM states.
Expected Behaviour:
In the UI, on the Instances screen, the Quickview popup window and the Details window must display the 'Reset SSH Key Pair' button in both VM states: running and stopped. When a user clicks on the 'Reset SSH Key Pair' button and a VM is in a running state, it will display a message "Vm xxx should be stopped to do SSH Key reset".
Actual Behaviour:
In the UI, on the Instances screen, the Quickview popup window and the Details window do not display the 'Reset SSH Key Pair' button for VMs in a running state. It only displays when the VM is in a stopped state.
In the Add Zone Wizard, when a user lands on the Physical Network page, by default the first Physical Network gets initialized with the 3 Traffic Types: Guest, Management and Public. When a user drags the Management or Public Traffic Types from the first Physical Network to a second or nth Physical Network and then clicks the next button to go to the next screen, and then decides to click the previous button to go back to the Physical Network screen, the UI initializes the physicalNetwork again and thus moves these Traffic Types back to their original position in the first Physical Network as if it is the first time the user navigated to this page.
A fix was made so that when a user clicks the previous button to go back to the Physical Network screen, it does not initialize the physicalNetwork again, therefore leaving the user-defined Traffic Type configuration as it was before the next button was clicked.
On the 'Register Template From URL' screen, when a user selects the KVM option from the Hypervisor dropdown:
1) It incorrectly displays the 'Original XS Version is 6.1' checkbox. This checkbox should be hidden in the KVM context.
2) The 'Root Disk Controller' dropdown should display the default option of 'osdefault' instead of a blank default option.
There was a concurrency problem with the “moveNetworkAclItem” API method. If two users were changing the ACL rules order at the same time, this could lead to inconsistent actions.
To solve the problem we added a “consistency check ” parameter, which is used to hold the consistency hash. This hash is created using an MD5 hash function on a String that is created with all ACL rules UUIDs concatenated in their order, which is defined via the ‘number’ field.
We also lock the editing of the ACL while executing the upgrade. This allows us to handle race conditions nicely, and present a good feedback for the user.
* [CLOUDSTACK-9261] Upgrate jQuery-UI to 1.11 (JQuery UI 1.8.4 prone to XSS)
* fix problems in the UI for lbCertificatePolicy and StaticNAT
* force jenkins build
* Fix about dialog
* Fix position of network service offering
* 4.11:
comment on unencryption
ui: fix create VPC dialog box failure when zone is SG enabled (#2704)
CLOUDSTACK-10381: Fix password reset / reset ssh key with ConfigDrive
isisnot=
extra message
debug message
imports
update without decrypt doesn't work
set unsensitive attributes as not 'Secure'
remove old config artifacts from update path
This introduces a rolling restart of VRs when networks are restarted
with cleanup option for isolated and VPC networks. A make redundant option is
shown for isolated networks now in UI.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Supporting ConfigDrive user data on L2 networks.
Add UI checkbox to create L2 network offering with config drive.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* CLOUDSTACK-10147 Disabled Xenserver Cluster can still deploy VM's. Added code to skip disabled clusters when selecting a host (#2442)
(cherry picked from commit c3488a51db)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* CLOUDSTACK-10318: Bug on sorting ACL rules list in chrome (#2478)
(cherry picked from commit 4412563f19)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* CLOUDSTACK-10284:Creating a snapshot from VM Snapshot generates error if hypervisor is not KVM.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* CLOUDSTACK-10221: Allow IPv6 when creating a Basic Network (#2397)
Since CloudStack 4.10 Basic Networking supports IPv6 and thus
should be allowed to be specified when creating a network.
Signed-off-by: Wido den Hollander <wido@widodh.nl>
(cherry picked from commit 9733a10ecd)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* CLOUDSTACK-10214: Unable to remove local primary storage (#2390)
Allow admins to remove primary storage pool.
Cherry-picked from eba2e1d8a1
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* dateutil: constistency of tzdate input and output (#2392)
Signed-off-by: Yoan Blanc <yoan.blanc@exoscale.ch>
Signed-off-by: Daan Hoogland <daan.hoogland@shapeblue.com>
(cherry picked from commit 2ad5202823)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* CLOUDSTACK-10054:Volume download times out in 3600 seconds (#2244)
(cherry picked from commit bb607d07a9)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* When creating a new account (via domain admin) it is possible to select “root admin” as the role for the new user (#2606)
* create account with domain admin showing 'root admin' role
Domain admins should not be able to assign the role of root admin to new users. Therefore, the role ‘root admin’ (or any other of the same type) should not be visible to domain admins.
* License and formatting
* Break long sentence into multiple lines
* Fix wording of method 'getCurrentAccount'
* fix typo in variable name
* [CLOUDSTACK-10259] Missing float part of secondary storage data in listAccounts
* [CLOUDSTACK-9338] ACS not accounting resources of VMs with custom service offering
ACS is accounting the resources properly when deploying VMs with custom service offerings. However, there are other methods (such as updateResourceCount) that do not execute the resource accounting properly, and these methods update the resource count for an account in the database. Therefore, if a user deploys VMs with custom service offerings, and later this user calls the “updateResourceCount” method, it (the method) will only account for VMs with normal service offerings, and update this as the number of resources used by the account. This will result in a smaller number of resources to be accounted for the given account than the real used value. The problem becomes worse because if the user starts to delete these VMs, it is possible to reach negative values of resources allocated (breaking all of the resource limiting for accounts). This is a very serious attack vector for public cloud providers!
* [CLOUDSTACK-10230] User should not be able to use removed “Guest OS type” (#2404)
* [CLOUDSTACK-10230] User is able to change to “Guest OS type” that has been removed
Users are able to change the OS type of VMs to “Guest OS type” that has been removed. This becomes a security issue when we try to force users to use HVM VMs (Meltdown/Spectre thing). A removed “guest os type” should not be usable by any users in the cloud.
* Remove trailing lines that are breaking build due to checkstyle compliance
* Remove unused imports
* fix classes that were in the wrong folder structure
* Updates to capacity management
This adds and allows Ubuntu 18.04 to be used as KVM host. In addition,
on the UI when hypervisor version key is missing, this adds and display
the host os and version detail which is useful to show the KVM host
os and version.
When cache mode 'none' is used for empty cdrom drives, systemvms
and guest VMs fail to start on newer libvirtd such as Ubuntu bionic.
The fix is ensure that cachemode is not declared when drives are empty
upon starting of the VM. Similar issue logged at redhat here:
https://bugzilla.redhat.com/show_bug.cgi?id=1342999
The workaround is to ensure that we don't configure cachemode for
cdrom devices at all. This also fixes live VM migration issue.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
After using the feature introduced by #2486 in production, we felt the need for an improvement in the UI. It is interesting to filter the displayed disk offerings according to the type of storage selected (local/shared) to migrate the volume to.
This fixes SAML2 certificate encoding/decoding issue due to refactoring
regression introduced in 7ce54bf7a8 that
did not account for base64 based encoding/decoding. The changes
effectively restore the same logic as used in previous versions.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* [CLOUDSTACK-5235] Force users to enter old password when updating password
* Formatting for checkstyle
* Remove an unused import in AccountManagerImpl
* Apply Nitin's suggestions
* Change 'oldPassword' to 'currentPassword'
* Second review of Resmo
* Fix typos found by Nitin
* [CLOUDSTACK-10323] Allow changing disk offering during volume migration
This is a continuation of work developed on PR #2425 (CLOUDSTACK-10240), which provided root admins an override mechanism to move volumes between storage systems types (local/shared) even when the disk offering would not allow such operation. To complete the work, we will now provide a way for administrators to enter a new disk offering that can reflect the new placement of the volume. We will add an extra parameter to allow the root admin inform a new disk offering for the volume. Therefore, when the volume is being migrated, it will be possible to replace the disk offering to reflect the new placement of the volume.
The API method will have the following parameters:
* storageid (required)
* volumeid (required)
* livemigrate(optional)
* newdiskofferingid (optional) – this is the new parameter
The expected behavior is the following:
* If “newdiskofferingid” is not provided the current behavior is maintained. Override mechanism will also keep working as we have seen so far.
* If the “newdiskofferingid” is provided by the admin, we will execute the following checks
** new disk offering mode (local/shared) must match the target storage mode. If it does not match, an exception will be thrown and the operator will receive a message indicating the problem.
** we will check if the new disk offering tags match the target storage tags. If it does not match, an exception will be thrown and the operator will receive a message indicating the problem.
** check if the target storage has the capacity for the new volume. If it does not have enough space, then an exception is thrown and the operator will receive a message indicating the problem.
** check if the size of the volume is the same as the size of the new disk offering. If it is not the same, we will ALLOW the change of the service offering, and a warning message will be logged.
We execute the change of the Disk offering as soon as the migration of the volume finishes. Therefore, if an error happens during the migration and the volume remains in the original storage system, the disk offering will keep reflecting this situation.
* Code formatting
* Adding a test to cover migration with new disk offering (#4)
* Adding a test to cover migration with new disk offering
* Update test_volumes.py
* Update test_volumes.py
* fix test_11_migrate_volume_and_change_offering
* Fix typo in Java doc
This extends securing of KVM hosts to securing of libvirt on KVM
host as well for TLS enabled live VM migration. To simplify implementation
securing of host implies that both host and libvirtd processes are
secured with management server's CA plugin issued certificates.
Based on whether keystore and certificates files are available at
/etc/cloudstack/agent, the KVM agent determines whether to use TLS or
TCP based uris for live VM migration. It is also enforced that a secured
host will allow live VM migration to/from other secured host, and an
unsecured hosts will allow live VM migration to/from other unsecured
host only.
Post upgrade the KVM agent on startup will expose its security state
(secured detail is sent as true or false) to the managements server that
gets saved in host_details for the host. This host detail can be accesed
via the listHosts response, and in the UI unsecured KVM hosts will show
up with the host state of ‘unsecured’. Further, a button has been added
that allows admins to provision/renew certificates to KVM hosts and can
be used to secure any unsecured KVM host.
The `cloudstack-setup-agent` was modified to accept a new flag `-s`
which will reconfigure libvirtd with following settings:
listen_tcp=0
listen_tls=1
tcp_port="16509"
tls_port="16514"
auth_tcp="none"
auth_tls="none"
key_file = "/etc/pki/libvirt/private/serverkey.pem"
cert_file = "/etc/pki/libvirt/servercert.pem"
ca_file = "/etc/pki/CA/cacert.pem"
For a connected KVM host agent, when the certificate are
renewed/provisioned a background task is scheduled that waits until all
of the agent tasks finish after which libvirt process is restarted and
finally the agent is restarted via AgentShell.
There are no API or DB changes.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
While executing the find/replace, I found some blocks of duplicated code. Therefore, I extracted the duplicated part to an utils file, and then removed the duplicated blocks.
We no longer hash password in the user side. All of the password processing is executed in the server side according to the priority of hashing mechanism defined by the administrator.
The host/alert dashboard panels are on the top side, the dashboard
statistics page gets less room. This increases the panel by 100px for
zone dashboard and decreases the host/alert panels by 100px.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* [CLOUDSTACK-10314] Add Text-Field to each ACL Rule
It is interesting to have a text field (e.g. CHAR-256) added to each ACL rule, which allows to enter a "reason" for each FW Rule created. This is valuable for customer documentation, as well as best practice for an evidence towards auditing the system
* Formatting to make check style happy and code clean ups
The ACL rules editing/addition page is not user-friendly. Users are not able to see in a single view all of the detail of the ACL rule (they need to use a scroll bar on the horizontal). The problem becomes worse when there are a considerable number of rules. Therefore, we are proposing the following changes:
1- Instead of using the table to create new ACL, we can create a button like the one presented in attached pictures, where users can click, and then a modal popup would appear and users would be able to create the new ACL there. This is similar to the workings of the ACL edit button.
2 - Remove the ability to add new ACL via table where they are presented. All ACLs should be entered via the “New ACL” button. Therefore, the section “Add ACL” would be removed as well;
3 - Move the action section of the list ACL table to the most left position;
These changes would reduce the information in the table and facilitate users to add new rules and easily edit them as well.
This fixes regression failures seen in Trillian, fixes NPEs that cause Travis related failures.
This also removes the aria2 dependency from rpms that require users to enable/install epel-release.
This finally updates the checksums for 4.11 systemvmtemplates in db upgrade path.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Allowed zone-wide primary storage based on a custom plug-in to be added via the GUI in a KVM-only environment (previously this only worked for XenServer and VMware)
Added support for root disks on managed storage with KVM
Added support for volume snapshots with managed storage on KVM
Enable creating a template directly from a volume (i.e. without having to go through a volume snapshot) on KVM with managed storage
Only allow the resizing of a volume for managed storage on KVM if the volume in question is either not attached to a VM or is attached to a VM in the Stopped state.
Included support for Reinstall VM on KVM with managed storage
Enabled offline migration on KVM from non-managed storage to managed storage and vice versa
Included support for online storage migration on KVM with managed storage (NFS and Ceph to managed storage)
Added support to download (extract) a managed-storage volume to a QCOW2 file
When uploading a file from outside of CloudStack to CloudStack, set the min and max IOPS, if applicable.
Included support for the KVM auto-convergence feature
The compression flag was actually added in version 1.0.3 (1000003) as opposed to version 1.3.0 (1003000) (changed this to reflect the correct version)
On KVM when using iSCSI-based managed storage, if the user shuts a VM down from the guest OS (as opposed to doing so from CloudStack), we need to pass to the KVM agent a list of applicable iSCSI volumes that need to be disconnected.
Added a new Global Setting: kvm.storage.live.migration.wait
For XenServer, added a check to enforce that only volumes from zone-wide managed storage can be storage motioned from a host in one cluster to a host in another cluster (cannot do so at the time being with volumes from cluster-scoped managed storage)
Don’t allow Storage XenMotion on a VM that has any managed-storage volume with one or more snapshots.
Enabled for managed storage with VMware: Template caching, create snapshot, delete snapshot, create volume from snapshot, and create template from snapshot
Added an SIOC API plug-in to support VMware SIOC
When starting a VM that uses managed storage in a cluster other than the one it last was running in, we need to remove the reference to the iSCSI volume from the original cluster.
Added the ability to revert a volume to a snapshot
Enabled cluster-scoped managed storage
Added support for VMware dynamic discovery
Extending Config Drive support
* Added support for VMware
* Build configdrive.iso on ssvm
* Added support for VPC and Isolated Networks
* Moved implementation to new Service Provider
* UI fix: add support for urlencoded userdata
* Add support for building systemvm behind a proxy
Co-Authored-By: Raf Smeets <raf.smeets@nuagenetworks.net>
Co-Authored-By: Frank Maximus <frank.maximus@nuagenetworks.net>
Co-Authored-By: Sigert Goeminne <sigert.goeminne@nuagenetworks.net>
CloudStack volumes and templates are one single virtual disk in case of XenServer/XCP and KVM hypervisors since the files used for templates and volumes are virtual disks (VHD, QCOW2). However, VMware volumes and templates are in OVA format, which are archives that can contain a complete VM including multiple VMDKs and other files such as ISOs. And currently, Cloudstack only supports Template creation based on OVA files containing a single disk. If a user creates a template from a OVA file containing more than 1 disk and launches an instance using this template, only the first disk is attached to the new instance and other disks are ignored.
Similarly with uploaded volumes, attaching an uploaded volume that contains multiple disks to a VM will result in only one VMDK to being attached to the VM.
FS: https://cwiki.apache.org/confluence/display/CLOUDSTACK/Support+OVA+files+containing+multiple+disks
This behavior needs to be improved in VMWare to support OVA files with multiple disks for both uploaded volumes and templates. i.e. If a user creates a template from a OVA file containing more than 1 disk and launches an instance using this template, the first disk should be attached to the new instance as the ROOT disk and volumes should be created based on other VMDK disks in the OVA file and should be attached to the instance.
Signed-off-by: Abhinandan Prateek <abhinandan.prateek@shapeblue.com>
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This feature allows using templates and ISOs avoiding secondary storage as intermediate cache on KVM. The virtual machine deployment process is enhanced to supported bypassed registered templates and ISOs, delegating the work of downloading them to primary storage to the KVM agent instead of the SSVM agent.
Template and ISO registration:
- When hypervisor is KVM, a checkbox is displayed with 'Direct Download' label.
- API methods registerTemplate and registerISO are both extended with this new parameter directdownload.
- On template or ISO registration, no download job is sent to SSVM agent, CloudStack would only persist an entry on template_store_ref indicating that template or ISO has been marked as 'Direct Download' (bypassing Secondary Storage). These entries are persisted as:
template_id = Template or ISO id on vm_template table
store_id NULL
download_state = BYPASSED
state = Ready
(Note: these entries allow users to deploy virtual machine from registered templates or ISOs)
- An URL validation command is sent to a random KVM host to check if template/ISO location can be reached. Metalink are also supported by this feature. In case of a metalink, it is fetched and URL check is performed on each of its URLs.
- Checksum should be provided as indicated on #2246: {ALGORITHM}CHKSUMHASH
- After template or ISO is registered, it would be displayed in the UI
Virtual machine deployment:
When a 'Direct Download' template is selected for deployment, CloudStack would delegate template downloading to destination storage pool via destination host by a new pluggable download manager.
Download manager would handle template downloading depending on URL protocol. In case of HTTP, request headers can be set by the user via vm_template_details. Those details should be persisted as:
Key: HTTP_HEADER
Value: HEADERNAME:HEADERVALUE
In case of HTTPS, a new API method is added uploadTemplateDirectDownloadCertificate to allow user importing a client certificate into all KVM hosts' keystore before deployment.
After template or ISO is downloaded to primary storage, usual entry would be persisted on template_spool_ref indicating the mapping between template/ISO and storage pool.
This feature allow admins to dedicate a range of public IP addresses to the SSVM and CPVM, such that they can be subject to specific external firewall rules. The option to dedicate a public IP range to the System VMs (SSVM & CPVM) is added to the createVlanIpRange API method and the UI.
Solution:
Global setting 'system.vm.public.ip.reservation.mode.strictness' is added to determine if the use of the system VM reservation is strict (when true) or preferred (false), false by default.
When a range has been dedicated to System VMs, CloudStack should apply IPs from that range to
the public interfaces of the CPVM and the SSVM depending on global setting's value:
If the global setting is set to false: then CloudStack will use any unused and unreserved public IP
addresses for system VMs only when the pool of reserved IPs has been exhausted
If the global setting is set to true: then CloudStack will fail to deploy the system VM when the pool
of reserved IPs has been exhausted, citing the lack of available IPs.
UI Changes
Under Infrastructure -> Zone -> Physical Network -> Public -> IP Ranges, button 'Account' label is refactored to 'Set reservation'.
When that button is clicked, dialog displayed is also refactored, including a new checkbox 'System VMs' which indicates if range should be dedicated for CPVM and SSVM, and a note indicating its usage.
When clicking on button for any created range, UI dialog displayed indicates whether IP range is dedicated for system vms or not.
This extends work presented on #2048 on which the ability to extend the management range is provided.
Aim
This PR allows separating the management network subnet on which SSVM and CPVM are from the virtual routers management subnet.
Detailed use case
PCI compliance requires that network elements are defined as ‘in scope’ or ‘out of scope’, for compliance purposes. The SSVM and CPVM are both in scope as they allow public HTTP or HTTPS connections. The virtual routers have been defined as out of scope as they have been placed entirely in a firewalled network's segment. However, all of the system VM types share management network. As SSVM and CPVM are both in scope this would bring the virtual routers into scope as well, requiring individual audits of every virtual router. As this is not practical, the ‘management network’ which the SSVM and CPVM are on, and the management network which the virtual routers are on, must be separated by a firewall.
Description
By this feature it is possible to dedicate a created range for SSVM and CPVM (system vms) and provide a VLAN ID for its range.
A new boolean global configuration is added: system.vm.management.ip.reservation.mode.strictness. If enabled, the use of System VMs management IP reservation is strict, preferred if not. Default value is false (preferred).
Strict reservation: System VMs should try to get a private IP from a range marked for system vms. If not available, deployment fails
Preferred reservation: System VMS will try to get a private IP from a range marked for system vms. If not available, IP for range not marked for system vms is taken.
Consider this scenario:
1. User launches a VM from Template and keep it running
2. Admin logins and deleted that template [CloudPlatform does not check existing / running VM etc. while the deletion is done]
3. User resets the VM
4. CloudPlatform fails to star the VM as it cannot find the corresponding template.
It throws error as
java.lang.RuntimeException: Job failed due to exception Resource [Host:11] is unreachable: Host 11: Unable to start instance due to can't find ready template: 209 for data center 1
at com.cloud.vm.VmWorkJobDispatcher.runJob(VmWorkJobDispatcher.java:113)
at org.apache.cloudstack.framework.jobs.impl.AsyncJobManagerImpl$5.runInContext(AsyncJobManagerImpl.java:495)
Client is requesting better handing of this scenario. We need to check existing / running VM's when the template is deleted and warn admin about the possible issue that may occur.
REPRO STEPS
==================
1. Launches a VM from Template and keep it running
2. Now delete that template
3. Reset the VM
4. CloudPlatform fails to star the VM as it cannot find the corresponding template.
EXPECTED BEHAVIOR
==================
Cloud platform should throw some warning message while the template is deleted if that template is being used by existing / running VM's
ACTUAL BEHAVIOR
==================
Cloud platform does not throw as waring etc.
* Cleanup and Improve NetUtils
This class had many unused methods, inconsistent names and redundant code.
This commit cleans up code, renames a few methods and constants.
The global/account setting 'api.allowed.source.cidr.list' is set
to 0.0.0.0/0,::/0 by default preserve the current behavior and thus
allow API calls for accounts from all IPv4 and IPv6 subnets.
Users can set it to a comma-separated list of IPv4/IPv6 subnets to
restrict API calls for Admin accounts to certain parts of their network(s).
This is to improve Security. Should an attacker steal the Access/Secret key
of an account he/she still needs to be in a subnet from where accounts are
allowed to perform API calls.
This is a good security measure for APIs which are connected to the public internet.
Signed-off-by: Wido den Hollander <wido@widodh.nl>
This fixes test failures around VMware with the new systemvmtemplate.
In addition:
- Does not skip rVR related test cases for VMware
- Removes rc.local
- Processes unprocessed cmd_line.json
- Fixed NPEs around VMware tests/code
- On VMware, use udevadm to reconfigure nic/mac address than rebooting
- Fix proper acpi shutdown script for faster systemvm shutdowns
- Give at least 256MB of swap for VRs to avoid OOM on VMware
- Fixes smoke tests for environment related failures
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- Several systemvmtemplate optimizations
- Uses new macchinina template for running smoke tests
- Switch to latest Debian 9.3.0 release for systemvmtemplate
- Introduce a new `get_test_template` that uses tiny test template
such as macchinina as defined test_data.py
- rVR related fixes and improvements
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- Fixes timezone issue where dates show up as nvalid in UI
- Introduces new event timeline listing/filtering of events
- Several UI improvements to add columns in list views
- Bulk operations support in instance list view to shutdown and destroy
multiple-selected VMs (limitation: after operation, redundant entries
may show up in the list view, refreshing VM list view fixes that)
- Align table thead/tbody to avoid splitting of tables
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This feature allows CloudStack administrators to create layer 2 networks on CloudStack. As these networks are purely layer 2, they don't require IP addresses or Virtual Router, only VLAN is necessary (provided by administrator or assigned by CloudStack). Also, network services should be handled externally, e.g. DNS, DHCP, as they are not provided by L2 networks.
As a consequence, a new Guest Network type is created within CloudStack: L2
Description:
Network offerings and networks support new guest type: L2.
L2 Network offering creation allows administrator to select Specify VLAN or let CloudStack assign it dynamically.
L2 Network creation allows administrator to specify VLAN tag (if network offerings allows it) or simply create network.
VM deployments on L2 networks:
VMs should not IP addresses or any network service
No Virtual Router deployed on network
If Specify VLAN = true for network offering, network gets implemented using a dynamically assigned VLAN
UI changes
A new button is added on Networks tab, available for admins, to allow L2 networks creation
At present, The management IP range can only be expanded under the same subnet. According to existing range, either the last IP can be forward extended or the first IP can be backward extended. But we cannot add an entirely different range from the same subnet. So the expansion of range is subnet bound, which is fixed. But when the range gets exhausted and a user wants to deploy more system VMs, then the operation would fail. The purpose of this feature is to expand the range of management network IPs within the existing subnet. It can also delete and list the IP ranges.
Please refer the FS here: https://cwiki.apache.org/confluence/display/CLOUDSTACK/Expansion+of+Management+IP+Range
This change adds allocatediops to the ListStoragePool API. This applies to managed storage where we have a guaranteed minimum IOPS set. This is useful for monitoring if we have reached the IOPS limit on a storage cluster.
The listNuageVspDomainTemplat cmd was called by the ui when the create vpc dialog was opened. This command failed when no nuage vsp device was present. As a consequence the ui did not show the dialog. So currently it's not possible to create a vpc through the UI with a native CloudStack deployment. This bugfix, adds robustness to the ui that in case the cmd fails the dialog will appear nonetheless . Furthermore I also changed the listNuageVspDomainTemplateCmd to always return an empty result when there is no nuage zone.
This shows the owner account and network of a VR in the VR list view,
and for VPCs shows the VPC name and redundant state of the VPC rVR.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Supports following viewing and navigation/filtering:
- Networks -> view instances (instances that have nics on this network)
- Infra-> VRs -> view instances (attached to the VR's guest network id),
view owner account (if not system, or project), view instances
- Infra -> VRs -> list of VPC redundant VRs will have redundant state in
parenthesis in the list
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* CLOUDSTACK-9972: Enhance listVolume API to include physical size and utilization.
Also fixed pool, cluster and pod info
* CLOUDSTACK-9972: Fix volume_view and duplicate API constant
* CLOUDSTACK-9972: Backport Do not allow vms to be deployed on hosts that are in disabled pod
* CLOUDSTACK-9972: Fix localization missing keys
* CLOUDSTACK-9972: Fix sql path
Allow security policies to apply on port groups:
- Accepts security policies while creating network offering
- Deployed network will have security policies from the network offering
applied on the port group (in vmware environment)
- Global settings as fallback when security policies are not defined for a network
offering
- Default promiscuous mode security policy set to REJECT as it's the default
for standard/default vswitch
Portgroup vlan-trunking options for dvswitch: This allows admins to define
a network with comma separated vlan id and vlan
range such as vlan://200-400,21,30-50 and use the provided vlan range to
configure vlan-trunking for a portgroup in dvswitch based environment.
VLAN overlap checks are performed for:
- isolated network against existing shared and isolated networks
- dedicated vlan ranges for the physical/public network for the zone
- shared network against existing isolated network
Allow shared networks to bypass vlan overlap checks: This allows admins
to create shared networks with a `bypassvlanoverlapcheck` API flag
which when set to 'true' will create a shared network without
performing vlan overlap checks against isolated network and against
the vlans allocated to the datacenter's physical network (vlan ranges).
Notes:
- No vlan-range overlap checks are performed when creating shared networks
- Multiple vlan id/ranges should include the vlan:// scheme prefix
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Several organizations use Cloudian as S3 provider, this implements the
Cloudian Management Console connector for CloudStack that can do the
following:
- Provide ease in connector configuration using CloudStack global
settings
- Perform SSO from CloudStack UI into Cloudian Management Console (CMC)
when the connector is enabled
- Automatic provisioning and de-provisioning of CloudStack accounts and
domains as Cloudian users and groups respectively
- During CloudStack UI logout, logout user from CMC
- CloudStack account will be mapped to Cloudian Users, and CloudStack
domain will be mapped to Cloudian Groups.
- The CloudStack admin account is mapped to Cloudian admin (user name
configurable).
- The user/group provisioning will be from CloudStack to Cloudian only,
i.e. user/group addition/removal/updation/deactivation in Cloudian
portal (CMC) won't propagate the changes to CloudStack.
FS: https://cwiki.apache.org/confluence/display/CLOUDSTACK/Cloudian+Connector+for+CloudStack
New APIs:
- `cloudianIsEnabled`: API to check whether Cloudian Connector is enabled.
- `cloudianSsoLogin`: Performs SSO for the logged-in, requesting user
and returns the URL that can be used to perform
SSO and log into CMC.
New Global Settings:
- cloudian.connector.enabled (false)
If set to true, this enables the Cloudian Connector for CloudStack.
Restarting management server(s) is required.
- cloudian.admin.host (s3-admin.cloudian.com)
The host where Cloudian Admin services are accessible.
- cloudian.admin.port (19443)
The admin service port.
- cloudian.admin.protocol (https)
The admin service API scheme/protocol.
- cloudian.validate.ssl (true)
When set to true, this validates the certificate of the https-enabled
admin API service.
- cloudian.admin.user (sysadmin)
The admin user's name when making (admin) API calls.
- cloudian.admin.password (public)
The admin password used when making (admin) API calls.
- cloudian.api.request.timeout (5)
The API request timeout in seconds used by the internal HTTP/s client.
- cloudian.cmc.admin.user (admin)
The CMC admin user's name.
- cloudian.cmc.host (cmc.cloudian.com)
The CMC host.
- cloudian.cmc.port (8443)
The CMC service port.
- cloudian.cmc.protocol (https)
The CMC service scheme/protocol.
- cloudian.sso.key (ss0sh5r3dk3y)
The Single-Sign-On shared key.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This commit is related to the Saml2 user authentication plugin.
The user can list its domains. His/Her domains are presented as the
following example:
username/subdomainA
username/subdomainB
However, if a user has two subdomains of the same name Dom1/subdomainA
and Dom2/subdomainA, the list is presented as follows:
username/subdomainA
username/subdomainA
With this commit it shows the full domain name to avoid such cases.
Thus, the domains will be presented as follows:
username/Dom1/subdomainA
username/Dom2/subdomainA
Root Cause:
The API returns the percentage value as floating point number but In UI it is converted to floor value of that number.
Hence for values less than 1%, the value is being converted to 0% and it doesn't show the value in the UI.
Solution:
Removed the conversion, now it represents as it is(Floating point value).
Host-HA offers investigation, fencing and recovery mechanisms for host that for
any reason are malfunctioning. It uses Activity and Health checks to determine
current host state based on which it may degrade a host or try to recover it. On
failing to recover it, it may try to fence the host.
The core feature is implemented in a hypervisor agnostic way, with two separate
implementations of the driver/provider for Simulator and KVM hypervisors. The
framework also allows for implementation of other hypervisor specific provider
implementation in future.
The Host-HA provider implementation for KVM hypervisor uses the out-of-band
management sub-system to issue IPMI calls to reset (recover) or poweroff (fence)
a host.
The Host-HA provider implementation for Simulator provides a means of testing
and validating the core framework implementation.
Signed-off-by: Abhinandan Prateek <abhinandan.prateek@shapeblue.com>
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This introduces a new certificate authority framework that allows
pluggable CA provider implementations to handle certificate operations
around issuance, revocation and propagation. The framework injects
itself to `NioServer` to handle agent connections securely. The
framework adds assumptions in `NioClient` that a keystore if available
with known name `cloud.jks` will be used for SSL negotiations and
handshake.
This includes a default 'root' CA provider plugin which creates its own
self-signed root certificate authority on first run and uses it for
issuance and provisioning of certificate to CloudStack agents such as
the KVM, CPVM and SSVM agents and also for the management server for
peer clustering.
Additional changes and notes:
- Comma separate list of management server IPs can be set to the 'host'
global setting. Newly provisioned agents (KVM/CPVM/SSVM etc) will get
radomized comma separated list to which they will attempt connection
or reconnection in provided order. This removes need of a TCP LB on
port 8250 (default) of the management server(s).
- All fresh deployment will enforce two-way SSL authentication where
connecting agents will be required to present certificates issued
by the 'root' CA plugin.
- Existing environment on upgrade will continue to use one-way SSL
authentication and connecting agents will not be required to present
certificates.
- A script `keystore-setup` is responsible for initial keystore setup
and CSR generation on the agent/hosts.
- A script `keystore-cert-import` is responsible for import provided
certificate payload to the java keystore file.
- Agent security (keystore, certificates etc) are setup initially using
SSH, and later provisioning is handled via an existing agent connection
using command-answers. The supported clients and agents are limited to
CPVM, SSVM, and KVM agents, and clustered management server (peering).
- Certificate revocation does not revoke an existing agent-mgmt server
connection, however rejects a revoked certificate used during SSL
handshake.
- Older `cloudstackmanagement.keystore` is deprecated and will no longer
be used by mgmt server(s) for SSL negotiations and handshake. New
keystores will be named `cloud.jks`, any additional SSL certificates
should not be imported in it for use with tomcat etc. The `cloud.jks`
keystore is stricly used for agent-server communications.
- Management server keystore are validated and renewed on start up only,
the validity of them are same as the CA certificates.
New APIs:
- listCaProviders: lists all available CA provider plugins
- listCaCertificate: lists the CA certificate(s)
- issueCertificate: issues X509 client certificate with/without a CSR
- provisionCertificate: provisions certificate to a host
- revokeCertificate: revokes a client certificate using its serial
Global settings for the CA framework:
- ca.framework.provider.plugin: The configured CA provider plugin
- ca.framework.cert.keysize: The key size for certificate generation
- ca.framework.cert.signature.algorithm: The certificate signature algorithm
- ca.framework.cert.validity.period: Certificate validity in days
- ca.framework.cert.automatic.renewal: Certificate auto-renewal setting
- ca.framework.background.task.delay: CA background task delay/interval
- ca.framework.cert.expiry.alert.period: Days to check and alert expiring certificates
Global settings for the default 'root' CA provider:
- ca.plugin.root.private.key: (hidden/encrypted) CA private key
- ca.plugin.root.public.key: (hidden/encrypted) CA public key
- ca.plugin.root.ca.certificate: (hidden/encrypted) CA certificate
- ca.plugin.root.issuer.dn: The CA issue distinguished name
- ca.plugin.root.auth.strictness: Are clients required to present certificates
- ca.plugin.root.allow.expired.cert: Are clients with expired certificates allowed
UI changes:
- Button to download/save the CA certificates.
Misc changes:
- Upgrades bountycastle version and uses newer classes
- Refactors SAMLUtil to use new CertUtils
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This feature allows changing permission for existing role permissions, as those were static and could not be changed once created. It also provides the ability to change these permissions in the UI using a drop down menu for each permission rule, in which admin can select ‘Allow’ or ‘Deny’ permission.
Changes in the API:
This feature modifies behaviour of updateRolePermission API method:
New optional parameters ‘ruleid’ and ‘permission’ are introduced, they are mutual exclusive to ‘ruleorder’ parameter. This defines two use cases:
Update role permission: ‘ruleid’ and ‘permission’ parameters needed
Update rules order: ‘ruleorder’ parameter needed
Parameter ‘ruleorder’ is now optional
updateRolePermission providing ‘ruleorder’ parameter should be sent via POST
A simple if-statement would fail if either the type or code were 0
as that if-statement failed them.
By checking if they are defined and casting them to a String afterwards
this makes the if-statement properly resolve and show the rule as it should.
Signed-off-by: Wido den Hollander <wido@widodh.nl>
The current VPN users are added in the VPN tab inside the public IP after the VPN is enabled. For each network(for which VPN is supported and enabled), the VPN users are shared. As the Cloudstack doc says “ The account owner can create and manage users for their VPN. CloudStack does not use its account database for this purpose but uses a separate table. The VPN user database is shared across all the VPNs created by the account owner. All VPN users get access to all VPNs created by the account owner.”
The current implementation of going inside each network and adding VPN users give the first feel as if the users are network based. To fix this, Shifted the VPN users to networks tab view.
This commit contains following changes
(1) add CPU CORE information in op_host_capacity
(2) add capacity name in the CapacityResponse
(3) add allocatedCapacity for CPU/MEMORY/CPU CORE for zones
(4) sort CapacityResponse by zonename and CapacityType
This allows native CloudStack users to change password in UI when LDAP
is enabled. Overall changes:
- A new usersource returned in the listUsers response
- Removed ldap check in the UI, replaced with check based on user source
- DB changes to include user.source in user_view
- Changed UI error message for non-native users trying to change password
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-9669:egress destination cidr VR python script changes
CLOUDSTACK-9669:egress destination API and orchestration changes
CLOUDSTACK-9669: Added the ipset package in systemvm template
CLOUDSTACK-9669:Added licence header for new files
CLOUDSTACK-9669: replacing 0.0.0.0/0 with the network cidr
ipset member add with 0.0.0.0/0 fails. So 0.0.0.0/0 replaced with the network cidr.
In source cidr 0.0.0.0/0 is nothing but network cidr.
updated the default egress all cidr with network cidr
* 4.9:
CLOUDSTACK-9857: With this change if agent dies the systemd will catch it properly and show process as exited
CLOUDSTACK-9805: Display VR list in network details
CLOUDSTACK-9356: FIX Cannot add users in VPC VPN
- commented some occurences of cloud.com as being harmless
* examples
* identifiers (internal)
- changed the URL for vhd-util download
- changed comments from 'cloud.com' to 'Apache CloudStack'
Reviewed-By: Rashmi Dixit
Problem: All the hosts suitable for VM Migration are not shown in the UI. This could
confuse the user as the target host might never be shown in the UI.
Root Cause: The API (findHostsForMigration) always returned page 1 results which would
be always <= default.page.size global parameter. Therefore, in case of large
no. of hosts where the result can map to multiple pages, this issue would arise.
Solution: 1. Replace drop-down with listView widget.
2. Allow lazy-loading of records on listView's scroll.
3. Show additional parameters (CPU/Memory used) to assist admin in decision making.
4. Provide 'Search by host name' to limit the results.
Added change where if there are no hosts found, an empty row with message will
appear.
Displays a VR tab that lists VRs for the network in the detail views for
isolated networks, shared networks and for VPCs.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This adds support for virtio-scsi on KVM hosts, either
for guests that are associated with a new os_type of 'Other PV Virtio-SCSI (64-bit)',
or when a VM or template is regstered with a detail parameter rootDiskController=scsi.
Update cloudstack add template dialog to allow for selecting rootDiskController with KVM
Update cloudstack kvm virtio-scsi to enable discard=unmap
CLOUDSTACK-9784 : GPU detail not displayed in GPU tab of management server UI.ISSUE
==================
When GPU tab of the host is selected on the management server UI, no GPU detail is displayed.
RESOLUTION
==================
In the javascript file "system.js" while fetching the GPU details, sort functionality in dataprovider is returning value as undefined and hence it throwing an exception. So handled the output as undefined gracefully to avoid exception.
**Screenshot before applying fix :**
**Screenshot after applying fix :**
* pr/1942:
CLOUDSTACK-9784 : GPU detail not displayed in GPU tab of management server UI.
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
This improves the metrics view feature by improving the rendering performance
of metrics view tables, by reimplementing the logic at the backend and data
served via APIs. In large environments, the older implementation would
make several API calls that increases both network and database load.
List of APIs introduced for improving the performance:
listClustersMetrics
listHostsMetrics
listInfrastructure
listStoragePoolsMetrics
listVMsMetrics
listVolumesMetrics
listZonesMetrics
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-9768: Time displayed for events in UI is incorrectTime displayed for events in UI is incorrect. Let's say, when we login using Japanese language the time displayed in the events is GMT instead of JST. However with English language the time is JST, as expected.
Example:
Time is displayed in the event is 10:40, if you are logged in using English language.
Whereas, time in the event shows 19:40 If you login with Japanese language.
* pr/1926:
CLOUDSTACK-9768: Time displayed for events in UI is incorrect
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
CLOUDSTACK-9228: Network update with mistmatch in services require forced option# Steps to reproduce:
1.Bring up CloudStack in advanced zone
2.Create isolated network with sourcenat, pf, lb, firewall services
3.Deploy a VM in the above network
4.Create another network offering with sourcenat, pf, firewall services
5.Try to update the network with offering created in step4
# Result:
The new offering:DefaultIsolatedNetworkOfferingForVpcNetworksNoLB will remove the following services [Lb]along with all the related configuration currently in use. will not proceed with the network update.set forced parameter to true for forcing an update."
# Workaround:
Use api with forced=true
# Fix:
Added a confirmation dialog box to check whether to make force update or not.
The dialog appears only for the Admin. Only admin can make force update.
The new dialog appears after the first CIDR unchanged confirmation dialog.
* pr/1333:
CLOUDSTACK-9228: Network update with mistmatch in services require forced option
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
CLOUDSTACK-9588: Add Load Balancer functionality in Network page is Redundant.Steps to Reproduce:
Network -> Select any network -> Observe Add Load Balancer tab
The "Add Load Balancer" functionality is redundant.
The above is used to create LB rule without any public IP.
Resolution:
There exist similar functionality in Network -> Any Network -> Details Tab -> View IP Addresses -> Any public IP -> Configuration Tab -> Observe Load Balancing.
The above is used to create LB rule with a public IP. This is a more convenient way of creating LB rule as the IP is involved.
* pr/1758:
CLOUDSTACK-9588: Add Load Balancer functionality in Network page is redundant. The "Add Load Balancer" functionality is redundant. The above is used to create LB rule without any public IP. This commit removes the tab from network page.
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
CLOUDSTACK-9679:Allow master user to manage subordinate user uploaded template
* pr/1834:
CLOUDSTACK-9679:Allow master user to manage subordinate user uploaded template
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
CLOUDSTACK-9574: Redesign storage views## Part 1: Redesign storage tags
### Actual behavior
Primary storage tags are being saved as an entry on `storage_pool_details` with:
* name = TAG_NAME
* value = "true"
When a boolean property is defined in {{storage_pool_details}} and has value = "true", it is displayed as a tag.
### Goal
Redesign `Storage Tags` for Primary Storage view, to list only tags, as it is done in Host Tags (Hosts view).
## Part 2: Remove details from listImageStores API call response and UI
### Description
In Secondary Storage view we propose removing `Details` field, as `Setting` tab list details for a given image store. We also remove details from response on `listImageStores` API method
* pr/1747:
CLOUDSTACK-9574: Redesign storage tags and remove details from listImageStores response and UI
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
Added a confirmation dialog box to check whether to make force update or not.
The dialog appears only for the Admin. Only admin can make force update.
The new dialog appears after the first CIDR unchanged confirmation dialog.
The "Add Load Balancer" functionality is redundant.
The above is used to create LB rule without any public IP.
This commit removes the tab from network page.
Updated StrongSwan VPN ImplementationThis PR is a merge of @jayapalu changes in #872 and the changes I had to make to get the functionality working.
I have done pretty extensive testing of this code so far and we are looking to be in pretty good shape. One thing to note is that a `Diffie-Hellman` group **is required** in order for this feature to work correctly. It is not highlighted in the tests below, but I have shown that the `PFS` is not required for this feature to work. In #872 I have shown a more exhaustive set of tests of this code, but I have limited this set of tests to a recommended `IKE` and `ESP` configuration in order to reduce the noise and test the other areas of functionality.
**Test Results**
I am testing this functionality by creating two VPCs with VMs in each and creating a S2S VPN connection between the two VPCs. Then I SSH into a VM in one VPC and I ping the private IP of a VM in the other VPC. Then I tear it down and try a different configuration.
_Setup_
```
VPC 1 VPC 2
===== =====
VPN Gateway VPN Gateway
VPN Customer Gateway VPN Customer Gateway
VPN Connection <---> VPN Connection
- Passive = True - Passive = False
```
_Legend_
`SKIP` => At least one of the VPN Connections did not come up, so no test was run.
`OK` => The ping test was successful over the S2S VPN connection.
`FAIL` => The ping test failed over the S2S VPN connection.
`Passive` => Specifies if either the `<vpc_1> : <vpc_2>` sides of the VPN Connection is set to passive.
`Conn State` => Specifies the connection status of the `<vpc_1> : <vpc_2>` VPN Connection in the UI.
`Requires Reset` => If the ping test does not result in an `OK`, then a VPN Connection Reset is performed on either `<vpc_1> : <vpc_2>` sides of the VPN Connection based on which side is not showing `Connected`. The results in the `Status` column is the final result after the reset is performed.
_Results_
```
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| Status | IKE & ESP | DPD | Encap | IKE Life | ESP Life | Passive | Conn State | Requires Reset |
+========+======================+=======+=======+==========+==========+===============+=============================+================+
| OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | True | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | | 3600 | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | 86400 | | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | | | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : False | Connected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | True | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : False | Connected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : False | Disconnected : Connected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | True : True | Disconnected : Disconnected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| OK | aes128-sha1;modp1536 | False | False | 86400 | 3600 | False : True | Connected : Disconnected | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| SKIP | aes128-sha1 | True | False | 86400 | 3600 | True : False | Disconnected : Error | True : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| SKIP | aes128-sha1 | False | False | 86400 | 3600 | True : False | Disconnected : Error | True : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| FAIL | aes128-sha1 | True | False | 86400 | 3600 | True : True | Disconnected : Disconnected | True : True |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
| SKIP | aes128-sha1 | True | False | 86400 | 3600 | False : False | Connected : Error | False : False |
+--------+----------------------+-------+-------+----------+----------+---------------+-----------------------------+----------------+
```
* pr/1741:
complete implementation of the StrongSwan VPN feature
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
deleted by deleting 1 template on any zone
added extra warning message if it's a cross-zone template ("This is a
cross zone template and will be deleted from all the zones. Are you sure
you want to proceed?").
[4.10] CLOUDSTACK-7985: assignVM in Advanced zone with Security GroupsThis commit contains the following changes:
(1) implementation of assignVM in Advanced zone with Security Groups
(2) keep the default nic on shared network when assignVM
(3) allow migrate vm from/to project;
(4) UI change for selecting account/project/network
* pr/844:
CLOUDSTACK-7985: assignVM in Advanced zone with Security Groups
CLOUDSTACK-7985: keep the default nic on shared network when assignVM
CLOUDSTACK-7985: (1) allow migrate vm from/to project; (2) UI change for selecting account/project/network
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
[4.10] CLOUDSTACK-8746: VM Snapshotting implementation for KVM
* pr/977:
Fixes for testing VM Snapshots on KVM. Related to PR 977
CLOUDSTACK-8746: vm snapshot implementation for KVM
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
This commit implements Ingress and Egress filtering for IPv6 in
Basic Networking.
It allows for opening and closing ports just as can be done with IPv4.
Rules have to be specified twice, once for IPv4 and once for IPv6, for
example:
- 22 until 22: 0.0.0.0/0
- 22 until 22: ::/0
Egress filtering works the same as with IPv4. When no rule is applied all
traffic is allowed. Otherwise only the specified traffic (with DNS being
the exception) is allowed.
Signed-off-by: Wido den Hollander <wido@widodh.nl>
(1) add support to create/delete/revert vm snapshots on running vms with QCOW2 format
(2) add new API to create volume snapshot from vm snapshot
(3) delete metadata of vm snapshots before stopping/migrating and recover vm snapshots after starting/migrating
(4) enable deleting of VM snapshot on stopped vm or vm snapshot is not listed in qcow2 image.
(5) enable smoke tests for vmsnaphsots on KVM
Update L10N files from Transifex (2016-11-27) for the new release 4.10.0.0I've check manually the correct display of the UI foreach language.
Don't forget to merge this before 4.10 release.
cc @jburwell @rhtyd
* pr/1789:
CLOUDSTACK-9621: Update L10N resource files with 4.10 strings from Transifex (20161127)
CLOUDSTACK-9621: Improve conversion Transifex's JSON format to CloudStack JS
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-9534: Allow VR to be destroy in UI when in running stateThis allows us to destroy a VR that is in running state from the UI. This action is possible via cloudmonkey/APIs, and would be useful for anyone who wants to simply destroy a VR from the UI without having to stop it first.
As this is a pure UI fix, manual testing would be needed but no regression integration testing is necessary.
/cc @jburwell @karuturi
@blueorangutan package
Screenshot:
* pr/1701:
CLOUDSTACK-9534: Allow VR to be destroy in UI when in running state
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-9438: Fix for CLOUDSTACK-9252 - Make NFS version changeable in UIJIRA TICKET: https://issues.apache.org/jira/browse/CLOUDSTACK-9438
### Introduction
From #1361 it was possible to configure NFS version for secondary storage mount.
However, changing NFS version requires inserting an new detail on `image_store_details` table, with `name = 'nfs.version'` and `value = X` where X is desired NFS version, and then restarting management server for changes to take effect.
Our improvement aims to make NFS version changeable from UI, instead of previously described workflow.
### Proposed solution
Basically, NFS version is defined as an image store ConfigKey, this implied:
* Adding a new Config scope: **ImageStore**
* Make `ImageStoreDetailsDao` class to extend `ResourceDetailsDaoBase` and `ImageStoreDetailVO` implement `ResourceDetail`
* Insert `'display'` column on `image_store_details` table
* Extending `ListCfgsCmd` and `UpdateCfgCmd` to support **ImageStore** scope, which implied:
** Injecting `ImageStoreDetailsDao` and `ImageStoreDao` on `ConfigurationManagerImpl` class, on `cloud-server` module.
### Important
It is important to mention that `ImageStoreDaoImpl` and `ImageStoreDetailsDaoImpl` classes were moved from `cloud-engine-storage` to `cloud-engine-schema` module in order to Spring find those beans to inject on `ConfigurationManagerImpl` in `cloud-server` module.
We had this maven dependencies between modules:
* `cloud-server --> cloud-engine-schema`
* `cloud-engine-storage --> cloud-secondary-storage --> cloud-server`
As `ImageStoreDaoImpl` and `ImageStoreDetailsDao` were defined in `cloud-engine-storage`, and they needed in `cloud-server` module, to be injected on `ConfigurationManagerImpl`, if we added dependency from `cloud-server` to `cloud-engine-storage` we would introduce a dependency cycle. To avoid this cycle, we moved those classes to `cloud-engine-schema` module
* pr/1615:
CLOUDSTACK-9438: Fix for CLOUDSTACK-9252 - Make NFS version changeable in UI
Signed-off-by: Rajani Karuturi <rajani.karuturi@accelerite.com>
Use available context to filter a metrics view based on zone, cluster, host
in the context object. This fixes metrics view filtering when metrics view is
viewed via Zone->Compute and Storage-> for a resource.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This allows admins/users to destroy a VR that is in running state from the UI.
This action is possible via cloudmonkey/APIs.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Move the localization resource files from Java Properties format to JSON Key-Value format
Change the Transifex sync script to handle JSON resource files instead of Properties files
Update the README
Remove old version from the Transifex configuration file
Remove unused gen-l10n.py script and update the ui/pom.xml to remove the execution of this script
We use some JSP file just for translation of strings in the UI. This is
achievable purely in JavaScript. This removes those JSPs, simplifies
translation usage and workflow (purely JS based). The l10n js (dictionary)
files are generated from existing messages.properties files during client-ui
code generation phase.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Add projectid to project details pageDisplay the project ID on the details view of a project.
* pr/1630:
Add to project detail page: cpu,memory,template,storage and VMs count
add projectid to project details page
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- Simplifies change password transactional logic without using pessmistic locks
- Adds a re-enter password field in the UI to valid ipmi/oobm password
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
The resize volume is support on all major hypervisors (Xen, VMware, KVM).
The hypervisor key is returned by the list volumes response only for admins
but not for users or domain admin users. This removes the check, as the operation
is supported on all major hypervisors that CloudStack supports.
With this changes all users would see resize volume button in the UI.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Taking fast and efficient volume snapshots with XenServer (and your storage provider)A XenServer storage repository (SR) and virtual disk image (VDI) each have UUIDs that are immutable.
This poses a problem for SAN snapshots, if you intend on mounting the underlying snapshot SR alongside the source SR (duplicate UUIDs).
VMware has a solution for this called re-signaturing (so, in other words, the snapshot UUIDs can be changed).
This PR only deals with the CloudStack side of things, but it works in concert with a new XenServer storage manager created by CloudOps (this storage manager enables re-signaturing of XenServer SR and VDI UUIDs).
I have written Marvin integration tests to go along with this, but cannot yet check those into the CloudStack repo as they rely on SolidFire hardware.
If anyone would like to see these integration tests, please let me know.
JIRA ticket: https://issues.apache.org/jira/browse/CLOUDSTACK-9281
Here's a video I made that shows this feature in action:
https://www.youtube.com/watch?v=YQ3pBeL-WaA&list=PLqOXKM0Bt13DFnQnwUx8ZtJzoyDV0Uuye&index=13
* pr/1403:
Faster logic to see if a cluster supports resigning
Support for backend snapshots with XenServer
Signed-off-by: Will Stevens <williamstevens@gmail.com>
Notify listeners when a host has been added to a cluster, is about to be removed from a cluster, or has been removed from a cluster
This PR addresses the following JIRA ticket:
https://issues.apache.org/jira/browse/CLOUDSTACK-8813
The problem is that there needs to be notifications sent when a host is added to, about to be removed from, and removed from a cluster.
Such notifications can be used for many purposes. For example, it can allow storage plug-ins to update ACLs on their storage systems. Also, it can allow us to clean up IQNs from ESXi hosts that are no longer needed.
* pr/816:
CLOUDSTACK-8813: Notify listeners when a host has been added to a cluster, is about to be removed from a cluster, or has been removed from a cluster
Signed-off-by: Will Stevens <williamstevens@gmail.com>
Support access to a host’s out-of-band management interface (e.g. IPMI, iLO,
DRAC, etc.) to manage host power operations (on/off etc.) and querying current
power state in CloudStack.
Given the wide range of out-of-band management interfaces such as iLO and iDRA,
the service implementation allows for development of separate drivers as plugins.
This feature comes with a ipmitool based driver that uses the
ipmitool (http://linux.die.net/man/1/ipmitool) to communicate with any
out-of-band management interface that support IPMI 2.0.
This feature allows following common use-cases:
- Restarting stalled/failed hosts
- Powering off under-utilised hosts
- Powering on hosts for provisioning or to increase capacity
- Allowing system administrators to see the current power state of the host
For testing this feature `ipmisim` can be used:
https://pypi.python.org/pypi/ipmisim
FS:
https://cwiki.apache.org/confluence/display/CLOUDSTACK/Out-of-band+Management+for+CloudStack
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-8562: Dynamic Role-Based API Checker for CloudStack### CLOUDSTACK-8562: DB-Backed Dynamic Role Based API Access Checker
This feature allows root administrators to define new roles and associate API
permissions to them.
A limited form of role-based access control for the CloudStack management server
API is provided through a properties file, commands.properties, embedded in the
WAR distribution. Therefore, customizing API permissions requires unpacking the
distribution and modifying this file consistently on all servers. The old system
also does not permit the specification of additional roles.
FS:
https://cwiki.apache.org/confluence/display/CLOUDSTACK/Dynamic+Role+Based+API+Access+Checker+for+CloudStack
DB-Backed Dynamic Role Based API Access Checker for CloudStack brings following
changes, features and use-cases:
- Moves the API access definitions from commands.properties to the mgmt server DB
- Allows defining custom roles (such as a read-only ROOT admin) beyond the
current set of four (4) roles
- All roles will resolve to one of the four known roles types (Admin, Resource
Admin, Domain Admin and User) which maintains this association by requiring
all new defined roles to specify a role type.
- Allows changes to roles and API permissions per role at runtime including additions or
removal of roles and/or modifications of permissions, without the need
of restarting management server(s)
Upgrade/installation notes:
- The feature will be enabled by default for new installations, existing
deployments will continue to use the older static role based api access checker
with an option to enable this feature
- During fresh installation or upgrade, the upgrade paths will add four default
roles based on the four default role types
- For ease of migration, at the time of upgrade commands.properties will be used
to add existing set of permissions to the default roles. cloud.account
will have a new role_id column which will be populated based on default roles
as well
Dynamic-roles migration tool: scripts/util/migrate-dynamicroles.py
- Allows admins to migrate to the dynamic role based checker at a future date
- Performs a harder one-way migrate and update
- Migrates rules from existing commands.properties file into db and deprecates it
- Enables an internal hidden switch to enable dynamic role based checker feature
* pr/1489:
maven: Fix jstl version usage
CLOUDSTACK-8562: Deprecate commands.properties
CLOUDSTACK-8562: DB-Backed Dynamic Role Based API Access Checker
CLOUDSTACK-9361: Centrally handle API validations
Signed-off-by: Will Stevens <williamstevens@gmail.com>
This feature allows root administrators to define new roles and associate API
permissions to them.
A limited form of role-based access control for the CloudStack management server
API is provided through a properties file, commands.properties, embedded in the
WAR distribution. Therefore, customizing API permissions requires unpacking the
distribution and modifying this file consistently on all servers. The old system
also does not permit the specification of additional roles.
FS:
https://cwiki.apache.org/confluence/display/CLOUDSTACK/Dynamic+Role+Based+API+Access+Checker+for+CloudStack
DB-Backed Dynamic Role Based API Access Checker for CloudStack brings following
changes, features and use-cases:
- Moves the API access definitions from commands.properties to the mgmt server DB
- Allows defining custom roles (such as a read-only ROOT admin) beyond the
current set of four (4) roles
- All roles will resolve to one of the four known roles types (Admin, Resource
Admin, Domain Admin and User) which maintains this association by requiring
all new defined roles to specify a role type.
- Allows changes to roles and API permissions per role at runtime including additions or
removal of roles and/or modifications of permissions, without the need
of restarting management server(s)
Upgrade/installation notes:
- The feature will be enabled by default for new installations, existing
deployments will continue to use the older static role based api access checker
with an option to enable this feature
- During fresh installation or upgrade, the upgrade paths will add four default
roles based on the four default role types
- For ease of migration, at the time of upgrade commands.properties will be used
to add existing set of permissions to the default roles. cloud.account
will have a new role_id column which will be populated based on default roles
as well
Dynamic-roles migration tool: scripts/util/migrate-dynamicroles.py
- Allows admins to migrate to the dynamic role based checker at a future date
- Performs a harder one-way migrate and update
- Migrates rules from existing commands.properties file into db and deprecates it
- Enables an internal hidden switch to enable dynamic role based checker feature
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-9194: Making the console popup window resizable in IE to make sure the focus is not losthttps://issues.apache.org/jira/browse/CLOUDSTACK-9194
To test:
Open any VM console in IE, and try resizing the browser window of console
It should be resizable.
* pr/1270:
CLOUDSTACK-9194: Making the console popup window resizable in IE to make sure the focus is not lost.
Signed-off-by: Will Stevens <williamstevens@gmail.com>
CLOUDSTACK-9322: Support for Internal LB fuctionality with Nuage VSP SDN Plugin including Marvin test coverageTask: https://issues.apache.org/jira/browse/CLOUDSTACK-9322
PR contents:
1) UI changes to support LB provider InternalLbVm during VPC offering creation.
2) Bug fix for CLOUDSTACK-9320.
3) Nuage VSP SDN Plugin related enhancements for VPC network functionality.
4) Marvin test coverage for Internal LB support on master with Nuage VSP SDN Plugin.
5) Enhancements on our exiting Marvin test code (nuagevsp plugins directory).
6) PEP8 & PyFlakes compliance with our Marvin test code.
Test run:
CloudStack$ nosetests --with-marvin --marvin-config=nuage_ant.cfg test/integration/plugins/nuagevsp/ -a tags=nuagevsp
Test results:
Test user data and password reset functionality with Nuage VSP SDN plugin ... === TestName: test_nuage_UserDataPasswordReset | Status : SUCCESS ===
ok
Test Nuage VSP VPC Offering with different combinations of LB service providers ... === TestName: test_01_nuage_internallb_vpc_Offering | Status : SUCCESS ===
ok
Test Nuage VSP VPC Network Offering with and without Internal LB service ... === TestName: test_02_nuage_internallb_vpc_network_offering | Status : SUCCESS ===
ok
Test Nuage VSP VPC Networks with and without Internal LB service ... === TestName: test_03_nuage_internallb_vpc_networks | Status : SUCCESS ===
ok
Test Nuage VSP VPC Internal LB functionality with different combinations of Internal LB rules ... === TestName: test_04_nuage_internallb_rules | Status : SUCCESS ===
ok
Test Nuage VSP VPC Internal LB functionality by performing (wget) traffic tests within a VPC ... === TestName: test_05_nuage_internallb_traffic | Status : SUCCESS ===
ok
Test Nuage VSP VPC Internal LB functionality with different LB algorithms by performing (wget) traffic tests ... === TestName: test_06_nuage_internallb_algorithms_traffic | Status : SUCCESS ===
ok
Test Nuage VSP VPC Internal LB functionality with restarts of VPC network components by performing (wget) ... === TestName: test_07_nuage_internallb_vpc_network_restarts_traffic | Status : SUCCESS ===
ok
Test Nuage VSP VPC Internal LB functionality with InternalLbVm appliance operations by performing (wget) ... === TestName: test_08_nuage_internallb_appliance_operations_traffic | Status : SUCCESS ===
ok
Test Basic VPC Network Functionality with Nuage VSP SDN plugin ... === TestName: test_nuage_vpc_network | Status : SUCCESS ===
ok
Test Nuage VSP SDN plugin with basic Isolated Network functionality ... === TestName: test_nuage_vsp | Status : SUCCESS ===
ok
----------------------------------------------------------------------
Ran 11 tests in 12094.705s
OK
Test run logs:
[results.txt](https://github.com/apache/cloudstack/files/187587/results.txt)
[runinfo.txt](https://github.com/apache/cloudstack/files/187588/runinfo.txt)
Test config file:
[nuage_ant.txt](https://github.com/apache/cloudstack/files/222711/nuage_ant.txt)
Note: Attached the Marvin config file as .txt instead of .cfg.
PEP8 & PyFlakes Compliance:
CloudStack$ pep8 --max-line-length=150 test/integration/plugins/nuagevsp/*.py
CloudStack$ pyflakes test/integration/plugins/nuagevsp/nuageTestCase.py
CloudStack$ pyflakes test/integration/plugins/nuagevsp/test_nuage_password_reset.py
CloudStack$ pyflakes test/integration/plugins/nuagevsp/test_nuage_vpc_internal_lb.py
CloudStack$ pyflakes test/integration/plugins/nuagevsp/test_nuage_vpc_network.py
CloudStack$ pyflakes test/integration/plugins/nuagevsp/test_nuage_vsp.py
CloudStack$ pyflakes test/integration/plugins/nuagevsp/*.py
#CLOUDSTACK-9322
* pr/1452:
CLOUDSTACK-9322 : Marvin tests for Internal Lb with Nuage VSP
CLOUDSTACK-9320 : InternalLBVM is not getting destroyed when the last Internal Load Balancer rule is removed for the corresponding source IP address
CLOUDSTACK-9322 : Changes to support InternalLbVm with Nuage VSP plugin
Signed-off-by: Will Stevens <williamstevens@gmail.com>
* 4.8:
CLOUDSTACK-9172 Added cross zones check to delete template and iso
Check the existence of 'forceencap' parameter before use
systemvm: set default umask 022 in injectkeys.sh
* 4.7:
CLOUDSTACK-9172 Added cross zones check to delete template and iso
Check the existence of 'forceencap' parameter before use
systemvm: set default umask 022 in injectkeys.sh
CLOUDSTACK-9172 Added cross zones check to delete template and isoAdded a check to ignore the zoneid, in the delete template UI, if the template is cross zones.
reference : CLOUDSTACK-9172
* pr/1505:
CLOUDSTACK-9172 Added cross zones check to delete template and iso
Signed-off-by: Will Stevens <williamstevens@gmail.com>
* 4.8:
CLOUDSTACK-9272: No option in UI to add GSLB with service type "HTTP"
CLOUDSTACK-9270: UI alignment gone bad in multiple places - VM Instance, Network, Egress rules
* 4.7:
CLOUDSTACK-9272: No option in UI to add GSLB with service type "HTTP"
CLOUDSTACK-9270: UI alignment gone bad in multiple places - VM Instance, Network, Egress rules
CLOUDSTACK-9272: No option in UI to add GSLB with service type "HTTP"Steps to Repro:
============
Go to Regions -> Local -> View GSLB -> Add GSLB
Click on the service type dropdown
Observe http is missing. Please see the attached snapshot.
Expected Behaviour:
================
As it supports http also, So http should be in the list.
Actual Behaviour:
==============
http is missing from the list.
Fix:
===
It supports http also. Added http to the list.
Snapshot:
========
<img width="531" alt="gslb-http-missing-nitin" src="https://cloud.githubusercontent.com/assets/12583725/12772818/21513dc0-ca5b-11e5-822e-e2dd2426da65.png">
* pr/1399:
CLOUDSTACK-9272: No option in UI to add GSLB with service type "HTTP"
Signed-off-by: Koushik Das <koushik@apache.org>
CLOUDSTACK-9268: Display VM in Load balancing rule in UISteps of Repro:
=============
1:Create VMs
2:Make LoadBalancing rule in GUI
Name:WWW
PrivatePort:80
PublicPort:80
Add VMs:some VMs
Expected Result:
==============
The VMs which has been already assigned is should not be listed when you add the VM to an existing rule.
Actual Result:
===========
The VMs which has been already assigned is still being listed when you add the VM to an existing rule.
Fix:
===
Added jsonObj to newly created row in multiedit.js to stop listing the same VM again.
* pr/1394:
CLOUDSTACK-9268: Display VM in Load balancing rule in UI
Signed-off-by: Koushik Das <koushik@apache.org>
This fixes a typographical error in UI that did not previously send fetchLatest
flag in the listCapacity API request.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-9174: A deleted account results in NPEWhen an account is deleted from cloudstack for which quota is still
being calculated and if the quota reaches minimum threshold then
quota service will try to alert the user. This results in NPE and is
fixed by excluding such accounts from alerting and other quota related
mechanisms.
* pr/1254:
CLOUDSTACK-9174: A deleted account results in NPE
Signed-off-by: Will Stevens <williamstevens@gmail.com>
The field we use most are now on the top:
- name
- state
- hypervisor
- link local ip
- redundant state
The other fields are nice, but not needed most of the time.
* 4.8:
Display hostname the VPC router runs on
CLOUDSTACK-9266: Make deleting static routes in private gw work
CLOUDSTACK-9264: Make /32 static routes for private gw work
* 4.7:
Display hostname the VPC router runs on
CLOUDSTACK-9266: Make deleting static routes in private gw work
CLOUDSTACK-9264: Make /32 static routes for private gw work
This is displayed on Infra tab and it's annoying that on the VPC
page only the link local is mentioned and not the hostname. That is
now corrected, so you have the correct details to login to the
router straight away.
This commit includes three changes:
(1) Revert commit 13bf1ec5da to show the 'root disk size' field
(2) Set the default value from '1' to empty. This also changes the default value of customized service offerings from '1' to empty.
(3) show 'root disk size' field only when users choose a KVM template, as cloudstack supports deployvm with rootdisksize on KVM only.
trailing commas in javascripts removedAccording to SonarQube this is a bug on internet explorer. It is the only 'blocker' level issue in cloudstack. @abhinandanprateek (@agneya2001) @bhaisaab @miguelaferreira should we enforce this or, as alternative, have it disabled in SonarQube?
* pr/1288:
trailing commas in javascripts removed
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* 4.7:
CLOUDSTACK-9254: Make longer names display pretty
CLOUDSTACK-9245 - Deletes ACL items when destroying the VPC or deleting the ACL itself
CLOUDSTACK-9245 - Formatting NetworkACLServiceImpl class
CLOUDSTACK-9245 - Formatting VpcManagerImpl class
CLOUDSTACK-9245 - Formatting NetworkACLManagerImpl class
More VR performance!
* 4.7:
CLOUDSTACK-9237: Create LB Healthcheck issues - button alignment and error message goes outside the window
CLOUDSTACK-9235: Autoscale button is missing in VPC
CLOUDSTACK-9229: Autoscale policy creation failing in VPC due to zoneid missing in createAutoScaleVmProfile
CLOUDSTACK-9229: Autoscale policy creation failing in VPC due to zone id missing in createAutoScaleVmProfileAutoscale policy creation is failing on VPC while creating autoscalevmprofile since zoneid parameter is missing.
Steps to Reproduce:
================
1. Create VPC Network offering with NS as service provider for LB
2. Create VPC using offering which has NetScaler as LB provider
3. Add a tier using the network offering created in Step1
4. Launch a VM
5. Acquire a public IP
6. Create an auto scale policy with all required parameters on an LB rule
Result:
======
Fails during autoscalevmprofile creation with the following error:
GET command=createAutoScaleVmProfile&response=json&serviceofferingid=05ac866f-604c-43e2-a48b-47e83ef7c4f1&templateid=3cdd83c4-ad27-11e5-9eaf-42407779c24b&destroyvmgraceperiod=30&counterparam%5B0%5D.name=snmpcommunity&counterparam%5B0%5D.value=public&counterparam%5B1%5D.name=snmpport&counterparam%5B1%5D.value=161&_=1451458073663
DEBUG [o.a.c.a.BaseCmd] (catalina-exec-10:ctx-58bcf6cf ctx-f5123e30) (logid:ae6742c8) Ignoring paremeter fordisplay as the caller is not authorized to pass it in
INFO [c.c.a.ApiServer] (catalina-exec-10:ctx-58bcf6cf ctx-f5123e30) (logid:ae6742c8) Unable to execute API command autoscalevmprofile due to missing parameter zoneid
Expected Result:
=============
Autoscale policy creation should be successful and the "min" number of VMs specified in the policy should be deployed.
Following should be the params for autoscalevmprofile creation:
command=createAutoScaleVmProfile&response=json&zoneid=0b43fff3-c069-417b-ac0c-e4dc46b407ea&serviceofferingid=0
5ac866f-604c-43e2-a48b-47e83ef7c4f1&templateid=3cdd83c4-ad27-11e5-9eaf-42407779c24b&destroyvmgraceperiod=30&counterparam%5B0%5D
.name=snmpcommunity&counterparam%5B0%5D.value=public&counterparam%5B1%5D.name=snmpport&counterparam%5B1%5D.value=161
Fix:
===
Added a conditon to check whether the zoneid in networks is undefined,
If that is undefined, it gets the zoneid from ipaddresses argument.
Fixed a localization issue.
* pr/1334:
CLOUDSTACK-9229: Autoscale policy creation failing in VPC due to zoneid missing in createAutoScaleVmProfile
Signed-off-by: Remi Bergsma <github@remi.nl>
CLOUDSTACK-9235: Autoscale button is missing in VPCAutoscale button is missing. This should not be the case since we are able to add NS as the external LB provider in VPC.
Steps:
=====
1. Create a VPC offering with NS as the external LB provider
2. Create a VPC and configure the public tier with the above offering
3. Acquire an IP address and try to configure Load Balancing rule
Result:
======
Autoscale option is not visible at all for the LB.
Expected Result:
=============
Autoscale option should be available and should work exactly like the way it works for a normal isolated network with NS. If we choose NS as service provider for LB, autoscale should also be visible. If VR is chosen, only then we should not display autoscale.
Fix:
===
In case of VPC, it checks the services available.
If LB is there, It checks the provider is Netscaler then it shows the button or hides it.
* pr/1337:
CLOUDSTACK-9235: Autoscale button is missing in VPC
Signed-off-by: Remi Bergsma <github@remi.nl>
* 4.7:
Refactor public ip retrieval into method
CLOUDSTACK-9244 Fix setting up RFC1918 routes
CLOUDSTACK-9239 throw exception on deprecated command
Enhance VR performance by selectively executing tasks instead of brute-forcing
CLOUDSTACK-9236: Load Balancing Health Check button displayed when non-NetScaler offering is used
CLOUDSTACK-9236: Load Balancing Health Check button displayed when non-NetScaler offering is usedLoad balancing health check option / button should only be displayed when a NetScaler based networking offering is being used.
If you try to use the health check option when NetScaler is not being used as the load balancing technology the UI throws an error stating that the health check option is not supported.
This button / option should be removed from the UI if NetScaler is not included in the network offering as customers will be confused.
Fix:
===
This button will be shown only when the load balancer is NetScaler.
Otherwise it is hidden.
* pr/1338:
CLOUDSTACK-9236: Load Balancing Health Check button displayed when non-NetScaler offering is used
Signed-off-by: Remi Bergsma <github@remi.nl>
CLOUDSTACK-9132: API createVolume takes empty string for name parameterSteps to Reproduce:
================
Create a volume using createVolume API where parameter name is empty.
It creates a volume with empty name.
But the name parameter is mandatory.(Issue)
Expected Behaviour:
================
It shouldn't create a volume with an empty name. Error should be returned.
Solution:
=======
Added a condition to check in case of empty string. If the name is an empty string, it generates a random name for the volume. Made the name field optional in UI as well as in API.
* pr/1319:
CLOUDSTACK-9132: API createVolume takes empty string for name parameter
Signed-off-by: Remi Bergsma <github@remi.nl>
- Implement Search boxes in all Metrics views
- Fix threshold calculations for host and storage pool metrics view
- Consider overcommit ratios for calculation allocated thresholds
- Save/pass context while navigating across resources and metrics view
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-9230: Remove unnecessary return statement from cloudStack.jsRemoved the unnecessary return statement.
The statement is never reached.
* pr/1335:
CLOUDSTACK-9230: Remove unnecessary return statement from cloudStack.js
Signed-off-by: Remi Bergsma <github@remi.nl>
* 4.7:
Fix unable to setup more than one Site2Site VPN Connection
FIX S2S VPN rVPC: Check only redundant routers in state MASTER
PEP8 of integration/smoke/test_vpc_vpn
Add S2S VPN test for Redundant VPC
Make integration/smoke/test_vpc_vpn Hypervisor independant
FIX VPN: non-working ipsec commands
[UI] MADNESS
[DB] Add force_encap field to s2s_customer_gateway table
[ROUTER] Add forceencaps field to python router ipsec config method
[TEST] unittest needs rework
[MARVIN] Add forceencap field to VpnCustomerGateway class in marvin base
[CORE] Add Force UDP Encapsulation option to Site2Site VPN
CLOUDSTACK-9186: Root admin cannot see VPC created by Domain admin user
CLOUDSTACK-9192: UpdateVpnCustomerGateway is failing
CLOUDSTACK-6485 prevent ip asignment of private gw iface
CLOUDSTACK-9204 Do not error when staticroute is already gone
make both check lines consistent
CLOUDSTACK-9181 Prevent syntax error in checkrouter.sh
CLOUDSTACK-9202 Bump ssh timeout
CLOUDSTACK-9192: UpdateVpnCustomerGateway is failingReproducible Steps:
================
1.Create a customer gateway for a VPC.
2.Edit it using UI(API call is UpdateVpnCustomerGateway).
3.When we try to update the customer vpn gateway with connection state is not in "Error", we see the API error but that won't be reflected to the user in UI.
Actual Behaviour:
==============
The API throws error. But UI doesn't show it to user.
Expected Behaviour:
================
The UI should show the error to user.
Fix:
===
TypeError: json.updatecustomergatewayresponse is undefined
The response name was wrong so corrected it.
It should be json.updatevpncustomergatewayresponse.
Added the error function.
* pr/1300:
CLOUDSTACK-9192: UpdateVpnCustomerGateway is failing
Signed-off-by: Remi Bergsma <github@remi.nl>
CLOUDSTACK-9186: Root admin cannot see VPC created by Domain admin userIssue:
=====
Root admin cannot see LB rules and Public LB IP addresses created by domain-admin in UI therefore root admin cannot manage those.
Reproducible Steps:
================
Log in as a Domain-Admin account and create a VPC with vpc virtual router as public load balancer provider
click on the newly created VPC -> click on the VPC tier -> click internal LB
Add internal LB,
Logoff domain-admin and login as root admin
Navigate the VPC created previously and click internal LB, internal lb is not showing up.
Same steps for Public LB IP addresses except select the correct Network offering while creating a tier.
Expected Behaviour:
================
Root admin should be able to manage VPC created by Domain admin user .
Actual Behaviour:
==============
Root admin cannot see VPC created by Domain admin user and hence not able to manage it.
Fix:
===
Added the parameter listAll=true in case of Internal LB as well as Public LB IP addresses.
* pr/1301:
CLOUDSTACK-9186: Root admin cannot see VPC created by Domain admin user
Signed-off-by: Remi Bergsma <github@remi.nl>
[4.7] ADD Force UDP encapsulation option to Site2Site VPNThis PR adds the option to enable forced UDP encapsulation of ESP packets during a setup of a site2site vpn. This options enforces the 'forceencaps' option in the openswan ipsec config:
https://wiki.strongswan.org/projects/strongswan/wiki/ConnSection
* pr/1317:
[UI] MADNESS
[DB] Add force_encap field to s2s_customer_gateway table
[ROUTER] Add forceencaps field to python router ipsec config method
[TEST] unittest needs rework
[MARVIN] Add forceencap field to VpnCustomerGateway class in marvin base
[CORE] Add Force UDP Encapsulation option to Site2Site VPN
Signed-off-by: Remi Bergsma <github@remi.nl>
Added a conditon to check whether the zoneid in networks is undefined,
If that is undefined, it gets the zoneid from ipaddresses argument.
Fixed a localization issue.
* 4.7:
CLOUDSTACK-9220 Sort list of domains on Domain tab in UI
Admin cannot see VMs on port forwarding page
Fix mariadb related listCapacity bug (CLOUDSTACK-8966)
CLOUDSTACK-9213 - Split the ACL rules using comma instead of dash.
CLOUDSTACK-9213 - Formatting the code
CLOUDSTACK-9221 Allow admin to see user VMs on port forwarding pageOn commit a902443708 the 'listAll=true' is removed. On some places the domainid and accountid are added but not on these. I added them now.
It's either doing this, or readding listAll is true. I've seeing other folks doing that so let's see what performs best.
* pr/1325:
Admin cannot see VMs on port forwarding page
Signed-off-by: Remi Bergsma <github@remi.nl>
On commir a902443708 the 'listAll=true'
is removed. On some places the domainid and accountid are added but not
on these. I added them now.
It's either doing this, or readding listAll is true. I've seeing other
folks doing that so let's see what performs best.
Added conditions to check if the name is empty or blank.
If it is empty or blank, then it generates a random name.
Made the name field as optional in UI as well as in API.
Added required unit tests.
When an account is deleted from cloudstack for which quota is still
being calculated and if the quota reaches minimum threshold then
quota service will try to alert the user. This results in NPE and is
fixed by excluding such accounts from alerting and other quota related
mechanisms.
Quota service: Fix check for admin account
* 4.6:
[UI] bug fix: Delete added ACL lists is not available for Domain Admin and normal users
CLOUDSTACK-4787: Allow users to select disk controller for VM/template
CLOUDSTACK-4787 Allow selection of scsi controller type in vSphere
[UI] bug fix: Delete added ACL lists is not available for Domain Admin and normal usersOnly the owner or domain admin/admin can access the page (vpc->Network ACL Lists), they are also able to remove the network ACL lists, which is not allowed on UI.
* pr/1211:
[UI] bug fix: Delete added ACL lists is not available for Domain Admin and normal users
Signed-off-by: Remi Bergsma <github@remi.nl>
[4.6] CLOUDSTACK-4787 - vmware diskcontrollersSame as #1131 (see this for screenshots etc)
* pr/1132:
CLOUDSTACK-4787: Allow users to select disk controller for VM/template
CLOUDSTACK-4787 Allow selection of scsi controller type in vSphere
Signed-off-by: Daan Hoogland <daan@onecht.net>
[4.7] CLOUDSTACK-9129: list vpc routers by keyword in Infrastructure -> Virtual Routers
and two more changes:
(1) add network name/vpc name in the listRouters response
(2) add network name/vpc id, vpc name in the router details page
* pr/1197:
CLOUDSTACK-9129: list vpc routers by keyword in Infrastructure -> Virtual Routers
Signed-off-by: Remi Bergsma <github@remi.nl>
Quota service while allowing for scalability will make sure that the cloud is
not exploited by attacks, careless use and program errors. To address this
problem, we propose to employ a quota-enforcement service that allows resource
usage within certain bounds as defined by policies and available quotas for
various entities. Quota service extends the functionality of usage server to
provide a measurement for the resources used by the accounts and domains using a
common unit referred to as cloud currency in this document. It can be configured
to ensure that your usage won’t exceed the budget allocated to accounts/domain
in cloud currency. It will let user know how much of the cloud resources he is
using. It will help the cloud admins, if they want, to ensure that a user does
not go beyond his allocated quota. Per usage cycle if a account is found to be
exceeding its quota then it is locked. Locking an account means that it will not
be able to initiat e a new resource allocation request, whether it is more
storage or an additional ip. Needless to say quota service as well as any action
on the account is configurable.
Changes from Github code review:
- Added marvin test for quota plugin API
- removed unused commented code
- debug messages in debug enabled check
- checks for nulls, fixed access to member variables and feature
- changes based on PR comments
- unit tests for UsageTypes
- unit tests for all Cmd classes
- unit tests for all service and manager impls
- try-catch-finally or try-with-resource in dao impls for failsafe db switching
- remove dead code
- add missing quota calculation case (regression fixed)
- replace tabs with spaces in pom.xmls
- quota: though default value for quota_calculated is 0, the usage server
makes it null while entering usage entries. Flipping the condition so
as to acocunt for that.
- quotatypes: fix NPE in quota type
- quota framework test fixes
- made statement period configurable
- changed default email templates to reflect the fact that exhausted quota may not result in a locked account
- added quotaUpdateCmd that refreshes quota balances and sends alerts and statements
- report quotaSummary command returns quota balance, quota usage and state for all account
- made UI framework changes to allow for text area input in edit views
- process usage entries that have greater than 0 usage
- orocess quota entries only if tariff is non zero
- if there are credit entries but no balance entry create a dummy balance entry
- remove any credit entries that are before the last balance entry
when displaying balance statement
- on a rerun the last balance is now getting added
FS: https://cwiki.apache.org/confluence/display/CLOUDSTACK/Quota+Service+-+FS
PR: https://github.com/apache/cloudstack/pull/768
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-9051: update nic IP address of stopped vmThis provides the feature to change ip address of NIC on a stopped vm by API and UI.
* pr/1086:
CLOUDSTACK-9051: reprogram network as a part of vm nic ip update
CLOUDSTACK-9051: add unit tests for UpdateVmNicIp
CLOUDSTACK-9051: update nic IP address of stopped vm
Signed-off-by: Daan Hoogland <daan@onecht.net>
CLOUDSTACK-8976 - Sorting of security groupsSimple change to sort the security groups in alphabetical order within the instance creation wizard.
This makes it much easier to find a security group when the user is presented with a long list.
* pr/937:
Sorting of security groups
Signed-off-by: Remi Bergsma <github@remi.nl>
[4.7] CLOUDSTACK-8958: add dedicated ips to domain (account for now)For now, we dedicate ip pool to account, however, other accounts in the same domain cannot fetch the ip from this ip pool.
By dedicating ip pool to domain, accounts in the domain can fetch the public ip from same ip pool.
* pr/1007:
CLOUDSTACK-8958: throw an exception if project account cannot be found
CLOUDSTACK-8958: add dedicated ips to domain (account for now)
Signed-off-by: Remi Bergsma <github@remi.nl>
[master] ui: Fix undefined check in instances.js, regression from 459d638(fix is already included in the https://github.com/apache/cloudstack/pull/1106 for 4.6 as well)
* pr/1119:
ui: Fix undefined check in instances.js, regression from 459d638
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
* 4.6:
Fix event UUIDS missing on event bus
Add select template dropdown when reinstall VM
CLOUDSTACK-9068: Listing Port Forwarding Rules take too much time to load
- Adds new controller types in the UI, for selecting root disk controller while
registering templates
- Fixes bug to not override disk controller type if provided in the details (either
vm details or from template details)
(cherry picked from commit c7d67628b3)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- Sortable columns
- Logos with cloudmonkey
- Wider UI
- CSS fixes and new status icons
- Configurable UI list api requests page size
- IP address column on instances page
- Listview widget enhancements
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Based on suggestion from Lucian (Nux), this patch increases the UI's container
width by 200px as most modern resolutions on desktop/laptops/workstations are
at least 1400px wide. By increasing the width and adjusting css properties
throughout the UI, we get more space to show information. This also gets
rid of horizontal scrollbar in case of metrics views. This also, fixes the UI
logos to include our mascot 'cloudmonkey'.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Add global setting that can be consumed by UI to make its pagesize for list API
calls dynamic with default to 100.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Implements various metrics views based on a listView based widget that has following
properties:
- vertically and horizontally scrollable with pagination/infinite scrolling
- sortable columns (client side)
- groupable/collapsible columns
- alternate row coloring
- refresh button to refresh views
- threshold table cell coloring
- panel/breadcrumb navigation
- quick view action column
- translatable labels
- sorts after metrics is refreshed, if a column was previously sorted
- sorts after adding rows on infinite scrolling if a column was pre-sorted
- Metrics views: Zones, Clusters, Hosts, Instances, Storage pools, Volumes
- Resource filtering/navigation: Zones->Clusters->Hosts->Instances->Volumes,
Storage Pool->Volumes
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Implements following in listView that generates tabular views;
- Collapsible columns in case of multi-header groupable columns
- Implements threshold coloring of cells in table
- Implements option to render a table that is scrollable in both x-y directions
- Support to only display status icon instead of label if compact is set to true
- Fixes quick-view alignment issue on Safari
- If a column was previously sorted, sorts after adding new rows
- If a supercolumn was collapsed, hides cell after adding new rows
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Implements sorting for tables across CloudStack UI;
- General alphabetic/string based sorting
- Numeric sorting for columns if data appears numeric
- Special sorting comparator for state columns
- Avoids sorting quick view columns and other specific columns
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Adds a new method to cloudBrowser that can remove the last panel and link/ref
from the breadcrumb
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
For setting the width of each data item for each row of Port Forwarding rules, it was processing all rules.
Basically for each data item, it was searching in all rules, which is un-necessary.
If there are N-Rules, It was processing N-times.
Now, it only processes one time by taking all N-rules at a time.
The previous solution was of O(NxN). Now its changed to O(N).
Fix some small UI bugs[UI] fix typo for user data field
[UI] Private Cloud VPC always shows 0 in Site-to-Site VPN, even when one is configured
[UI] change the Icon for changing ACL's for a tier in a VPC
[UI] Network names are not being displayed in Infra VRs router NICS
* pr/1034:
[UI] change alert to ui dialog in response of instance wizard
[UI] Network names are not being displayed in Infra » VRs » router » NICS
[UI] change the Icon for changing ACL's for a tier in a VPC
[UI] Private Cloud VPC always shows 0 in Site-to-Site VPN, even when one is configured
[UI] fix typo for user data field
Signed-off-by: Remi Bergsma <github@remi.nl>
CLOUDSTACK-9044: Add RBD Primary Storage to the Zone Wizard.Added to option to use RBD as primary storage in the Zone Wizard.
Pure UI change.
* pr/1046:
CLOUDSTACK-9044: Add RBD Primary Storage to the Zone Wizard.
Signed-off-by: Remi Bergsma <github@remi.nl>
CLOUDSTACK-8913: Search box in Templates tab out of alignmentIncreased the margin and padding to accomodate all the boxes inside toolbar.
* pr/891:
CLOUDSTACK-8913: Search box in Templates tab out of alignment
Signed-off-by: Remi Bergsma <github@remi.nl>
CLOUDSTACK-8919: Slow UI response while loading the list of networks in network tab.Instead of searching for each network, now it is searching for each zone.
For basic zone, it will show the security group directly because by default securitygroupsenabled is true.
For advanced zone, check the securitygroupsenabled option in each zone. If any one has value true, then show.
* pr/897:
CLOUDSTACK-8919: Slow UI response while loading the list of networks in network tab.
Signed-off-by: Remi Bergsma <github@remi.nl>
While calling the listNics API, instead of sending the default nic id as parameter, it should send the network id as a parameter.
So, replaced that nicid parameter as networkid parameter.
Instead of searching for each network, now it is searching for each zone.
For basic zone, it will show the security group directly because by default securitygroupsenabled is true.
For advanced zone, check the securitygroupsenabled option in each zone. If any one has value true, then show.
FIX: Ovm3 physical network traffic labels to work.The labeling was broken. Only labels assigned at zone creation
were used, changing labels was not working. Tested with changing
a label and checking it, labels at zone creation still works.
As a bonus fixed the consistency of KVM in Dutch compared to other
traffic labels in Dutch and copied in the OVM3 translated label
in other languages based on the other tarffic labels in those languages.
* pr/964:
FIX: Ovm3 physical network traffic labels to work.
Signed-off-by: Remi Bergsma <github@remi.nl>
The labeling was broken. Only labels assigned at zone creation
were used, changing labels was not working. Tested with changing
a label and checking it.
As a bonus fixed the consistency of KVM in Dutch compared to other
traffic labels in dutch and copied in the OVM3 translated label
in other languages.
CLOUDSTACK-8821: UI Change while configuring firewall rule.It provides appropriate message in the UI when configuring the firewall rules in Network page.
If the default egress policy is allow, then it says to block traffic. If the default egress policy is deny, then it says to allow traffic.
* pr/791:
CLOUDSTACK-8821: Provide appropriate message in the UI when configuring the Firewall rules.
Signed-off-by: Daan Hoogland <daan@onecht.net>
Cloudstack:8647 LDAP Trust AD and AutoimportToday, CloudStack can automatically import LDAP users based on the configuration to a domain or an account. However, any new users in LDAP aren't automatically reflected. The admin has to manually import them again.
This feature enables admin to map LDAP group/OU to a CloudStack domain and any changes are reflected in ACS as well.
FS: https://cwiki.apache.org/confluence/display/CLOUDSTACK/WIP%3A+LDAP%3A+Trust+AD+and+Auto+Import
testcases output:
```
-------------------------------------------------------
T E S T S
-------------------------------------------------------
Running groovy.org.apache.cloudstack.ldap.NoLdapUserMatchingQueryExceptionSpec
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.216 sec - in groovy.org.apache.cloudstack.ldap.NoLdapUserMatchingQueryExceptionSpec
Running groovy.org.apache.cloudstack.ldap.LdapManagerImplSpec
log4j:WARN No appenders could be found for logger (org.apache.cloudstack.ldap.LdapManagerImpl).
log4j:WARN Please initialize the log4j system properly.
log4j:WARN See http://logging.apache.org/log4j/1.2/faq.html#noconfig for more info.
using type:
using type: null
using type: TEST
using type: TEST TEST
using name:
using name: null
using accountType: -1
using accountType: 1
using accountType: 3
using accountType: 4
using accountType: 5
using accountType: 6
using accountType: 20000
using accountType: -500000
Tests run: 29, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.387 sec - in groovy.org.apache.cloudstack.ldap.LdapManagerImplSpec
Running groovy.org.apache.cloudstack.ldap.LdapListUsersCmdSpec
Tests run: 6, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.041 sec - in groovy.org.apache.cloudstack.ldap.LdapListUsersCmdSpec
Running groovy.org.apache.cloudstack.ldap.LdapAddConfigurationCmdSpec
Tests run: 6, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.019 sec - in groovy.org.apache.cloudstack.ldap.LdapAddConfigurationCmdSpec
Running groovy.org.apache.cloudstack.ldap.LdapUserSpec
Tests run: 9, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.021 sec - in groovy.org.apache.cloudstack.ldap.LdapUserSpec
Running groovy.org.apache.cloudstack.ldap.LdapAuthenticatorSpec
Tests run: 10, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.082 sec - in groovy.org.apache.cloudstack.ldap.LdapAuthenticatorSpec
Running groovy.org.apache.cloudstack.ldap.LdapConfigurationVOSpec
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.004 sec - in groovy.org.apache.cloudstack.ldap.LdapConfigurationVOSpec
Running groovy.org.apache.cloudstack.ldap.OpenLdapUserManagerSpec
Tests run: 12, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.094 sec - in groovy.org.apache.cloudstack.ldap.OpenLdapUserManagerSpec
Running groovy.org.apache.cloudstack.ldap.LdapDeleteConfigurationCmdSpec
Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.008 sec - in groovy.org.apache.cloudstack.ldap.LdapDeleteConfigurationCmdSpec
Running groovy.org.apache.cloudstack.ldap.LdapUserResponseSpec
Tests run: 7, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.01 sec - in groovy.org.apache.cloudstack.ldap.LdapUserResponseSpec
Running groovy.org.apache.cloudstack.ldap.LdapUserManagerFactorySpec
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.027 sec - in groovy.org.apache.cloudstack.ldap.LdapUserManagerFactorySpec
Running groovy.org.apache.cloudstack.ldap.ADLdapUserManagerImplSpec
Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.012 sec - in groovy.org.apache.cloudstack.ldap.ADLdapUserManagerImplSpec
Running groovy.org.apache.cloudstack.ldap.LdapCreateAccountCmdSpec
Tests run: 11, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.168 sec - in groovy.org.apache.cloudstack.ldap.LdapCreateAccountCmdSpec
Running groovy.org.apache.cloudstack.ldap.LdapImportUsersCmdSpec
Tests run: 9, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.063 sec - in groovy.org.apache.cloudstack.ldap.LdapImportUsersCmdSpec
Running groovy.org.apache.cloudstack.ldap.LinkDomainToLdapCmdSpec
Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.019 sec - in groovy.org.apache.cloudstack.ldap.LinkDomainToLdapCmdSpec
Running groovy.org.apache.cloudstack.ldap.LdapSearchUserCmdSpec
Tests run: 4, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.011 sec - in groovy.org.apache.cloudstack.ldap.LdapSearchUserCmdSpec
Running groovy.org.apache.cloudstack.ldap.LdapListConfigurationCmdSpec
Tests run: 6, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.01 sec - in groovy.org.apache.cloudstack.ldap.LdapListConfigurationCmdSpec
Running groovy.org.apache.cloudstack.ldap.NoSuchLdapUserExceptionSpec
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.005 sec - in groovy.org.apache.cloudstack.ldap.NoSuchLdapUserExceptionSpec
Running groovy.org.apache.cloudstack.ldap.LdapConfigurationResponseSpec
Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.006 sec - in groovy.org.apache.cloudstack.ldap.LdapConfigurationResponseSpec
Running groovy.org.apache.cloudstack.ldap.LdapConfigurationSpec
asserting for provider configuration: openldap
asserting for provider configuration: microsoftad
asserting for provider configuration:
asserting for provider configuration:
asserting for provider configuration: xyz
asserting for provider configuration: MicrosoftAd
asserting for provider configuration: OpenLdap
asserting for provider configuration: MicrosoftAD
Tests run: 19, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.053 sec - in groovy.org.apache.cloudstack.ldap.LdapConfigurationSpec
Running groovy.org.apache.cloudstack.ldap.LdapContextFactorySpec
Tests run: 5, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.099 sec - in groovy.org.apache.cloudstack.ldap.LdapContextFactorySpec
Running groovy.org.apache.cloudstack.ldap.LdapConfigurationDaoImplSpec
Tests run: 1, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.027 sec - in groovy.org.apache.cloudstack.ldap.LdapConfigurationDaoImplSpec
Running groovy.org.apache.cloudstack.ldap.LdapUtilsSpec
Tests run: 3, Failures: 0, Errors: 0, Skipped: 0, Time elapsed: 0.01 sec - in groovy.org.apache.cloudstack.ldap.LdapUtilsSpec
Results :
Tests run: 156, Failures: 0, Errors: 0, Skipped: 0
```
* pr/755:
CLOUDSTACK-8647: linkdomaintoldap shouldnt fail when createuseraccount fails
CLOUDSTACK-8647 removed duplicate key in create sql of ldap_trust_map
CLOUDSTACK-8647: string formatting
CLOUDSTACK-8647: updated with review comments
CLOUDSTACK-8647: unittests for LdapAuthenticatorSpec
CLOUDSTACK-8647: formatted LdapAuthenticatorSpec
CLOUDSTACK-8647: UI for trust AD feature
CLOUDSTACK-8647 added unittests for new methods in ldapmanager
CLOUDSTACK-8647 unittests for LinkDomainToLdap api command
CLOUDSTACK-8647: fixed unittests
CLOUDSTACK-8647 support for assigning and admin to linked ldap domain
CLOUDSTACK-8647 added nested group enabled config in ldap
CLOUDSTACK-8647 added account_type to the linkDomainToLdap API
CLOUDSTACK-8647 changed the authentication flow
CLOUDSTACK-8647 added new api linkLdapToDomain
CLOUDSTACK-8647: added cmd and response class for the new api
Signed-off-by: Rajani Karuturi <rajani.karuturi@citrix.com>
Guys, can you review it? things need to be discussed:
(1) this supports KVM/QCOW2 only. Anyone want to implement for other Hypervisor/format ?
(2) The original data volume (on primary storage) will be removed.
(3) The script uses the default timeout in libvirtComputingResource. Do we need to add one in global configuration (like copy.volume.wait or backup.snapshot.wait, create.volume.from.snapshot.wait)
(4) In scripts/storage/qcow2/managesnapshot.sh, I use "qemu-img convert -f qcow2 -O qcow2" to copy the snapshot from secondary to primary (hence there is no base image file), instead of "cp -f", this is because convert is faster than cp in my testing.
* pr/732:
CLOUDSTACK-5863: revert volume snapshot for KVM/QCOW2
Signed-off-by: Wei Zhou <w.zhou@tech.leaseweb.com>
Due to aggregation of templates and isos on the UI/client side, it could result
that for each page we could end up having lesser templates/isos listed to have
the scroll shown that triggers infinite scrolling. In theory, there
is still a chance if there are several zones with the same template being listed
resulting in only one aggregated template which could cause the scroll to not
get shown; but in practice I believe this fix should work for most users.
Page size set based on experimental data:
https://github.com/apache/cloudstack/pull/751#issuecomment-135661968
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Uses listViewDataProvider to implement pagination for listing templates and ISOs
in the zones tab. Dedupes isos and templates in the list views.
This closes#740
(cherry picked from commit 26700fbe76)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
CLOUDSTACK-8744 Add missing localization (l10n) for several parts in the UI
- l10n for the SSH Key Pairs behavior
- l10n for Autoscaling / LB sections
- l10n for Reset password
- l10n on some strings for the installation Wizard
- l10n on some strings in VPN/VPC section
- l10n on Service offerings sections
- improve some FR translations
* pr/712:
CLOUDSTACK-8744 Add missing localization (l10n) for several parts in the UI - l10n for the SSH Key Pairs behavior - l10n for Autoscaling / LB sections - l10n for Reset password - l10n on some strings for the installation Wizard - l10n on some strings in VPN/VPC section - l10n on Service offerings sections - improve some FR translations
Signed-off-by: Rajani Karuturi <rajanikaruturi@gmail.com>
- l10n for the SSH Key Pairs behavior
- l10n for Autoscaling / LB sections
- l10n for Reset password
- l10n on some strings for the installation Wizard
- l10n on some strings in VPN/VPC section
- l10n on Service offerings sections
- improve some FR translations
[CLOUDSTACK-8427] Add missing localization for some labels in Web UI- on new functionnality: upload volume/template from Local
- on the zone configuration wizard for the "Next" button
- update French messages properties from transifex
- Improve some French translations ("Tlverser" for "Upload")
* pr/686:
Add missing localization for some labels in Web UI - on new functionnality: upload volume/template from Local - on the zone configuration wizard for the "Next" button - update French messages properties from transifex - Improve some French translations ("Téléverser" for "Upload")
Signed-off-by: Remi Bergsma <github@remi.nl>
Interface changes related to CLOUDSTACK-8580See issue CLOUDSTACK-8580 and individual commits.
* pr/680:
Made interface changes related to CLOUDSTACK-8580
Signed-off-by: Remi Bergsma <github@remi.nl>
Added responses to ListCapabilities to reflect CLOUDSTACK-8580 changes.
This to add these options to the gui. See issue CLOUDSTACK-8580.
3be14e978a
Removed comments as proposed by Daan Hoogland.
SAML authorized accounts might be across various domains, this allows for
switching of accounts only in case of SAML authenticated user accounts across
other accounts with the same SAML uid/username.
Moves the previous switch account logic to its own ui-custom module
(cherry picked from commit 1065661cd5)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Conflicts:
plugins/user-authenticators/saml2/src/org/apache/cloudstack/api/command/SAML2LoginAPIAuthenticatorCmd.java
ui/index.jsp
- on new functionnality: upload volume/template from Local
- on the zone configuration wizard for the "Next" button
- update French messages properties from transifex
- Improve some French translations ("Téléverser" for "Upload")
This uses local selector to access the DOM elements, the previous commit
would find a global element which is not in the context and fail changing the
element in the opened dialog.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This closes#583
Add option to authorize SAML SSO for user when adding user. Appends a domain to
user/account name if global setting is enabled, useful in case of multiple IDP
server. By default the setting is set to false (keep as it is).
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This closes#575
(cherry picked from commit 7d11c7bc70)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- Login is based on sessionkey HttpOnly Cookie
- ApiServlet does login verification using sessionKey from both the request cookies
and the API parameters. In both cases, if either or both are passed they should
match the sessionKey stored in the current session of the HttpRequest
- UI: it no longer needs to read or set sessionkey cookie
- UI: it no longer needs to return g_sessionKey value in the API requests, though
to support a sso mechanism g_sessionKey is still passed in the API is not null
- Secure jsessionid cookie is set to be HttpOnly and Secure
- SAML login should also set HttpOnly cookie before redirecting to UI
- SAML: listIdps & getSPMetadata APIs are readonly now, won't log out a logged in user
Performed tests (login, saml login if applicable, page refreshes, opening
multiple tabs, logout) with following combinations:
- SAML disabled, normal auth as admin, domain-admin and user
- SAML enabled, normal auth as admin, domain-admin and user; and saml sso as
admin, domain-admin and user
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This closes#574
This closes#308
Introduces a boolean option in UI plugins setting it to 'true' would display
the UI plugin on the left navigation bar.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This closes#563
* Move config options to SAML plugin
This moves all configuration options from Config.java to SAML auth manager. This
allows us to use the config framework.
* Make SAML2UserAuthenticator validate SAML token in httprequest
* Make logout API use ConfigKeys defined in saml auth manager
* Before doing SAML auth, cleanup local states and cookies
* Fix configurations in 4.5.1 to 4.5.2 upgrade path
* Fail if idp has no sso URL defined
* Add a default set of SAML SP cert for testing purposes
Now to enable and use saml, one needs to do a deploydb-saml after doing a deploydb
* UI remembers login selections, IDP server
- CLOUDSTACK-8458:
* On UI show dropdown list of discovered IdPs
* Support SAML Federation, where there may be more than one IdP
- New datastructure to hold metadata of SP or IdP
- Recursive processing of IdP metadata
- Fix login/logout APIs to get new interface and metadata data structure
- Add org/contact information to metadata
- Add new API: listIdps that returns list of all discovered IdPs
- Refactor and cleanup code and tests
- CLOUDSTACK-8459:
* Add HTTP-POST binding to SP metadata
* Authn requests must use either HTTP POST/Artifact binding
- CLOUDSTACK-8461:
* Use unspecified x509 cert as a fallback encryption/signing key
In case a IDP's metadata does not clearly say if their certificates need to be
used as signing or encryption and we don't find that, fallback to use the
unspecified key itself.
- CLOUDSTACK-8462:
* SAML Auth plugin should not do authorization
This removes logic to create user if they don't exist. This strictly now
assumes that users have been already created/imported/authorized by admins.
As per SAML v2.0 spec section 4.1.2, the SP provider should create authn requests using
either HTTP POST or HTTP Artifact binding to transfer the message through a
user agent (browser in our case). The use of HTTP Redirect was one of the reasons
why this plugin failed to work for some IdP servers that enforce this.
* Add new User Source
By reusing the source field, we can find if a user has been SAML enabled or not.
The limitation is that, once say a user is imported by LDAP and then SAML
enabled - they won't be able to use LDAP for authentication
* UI should allow users to pass in domain they want to log into, though it is
optional and needed only when a user has accounts across domains with same
username and authorized IDP server
* SAML users need to be authorized before they can authenticate
- New column entity to track saml entity id for a user
- Reusing source column to check if user is saml enabled or not
- Add new source types, saml2 and saml2disabled
- New table saml_token to solve the issue of multiple users across domains and
to enforce security by tracking authn token and checking the samlresponse for
the tokens
- Implement API: authorizeSamlSso to enable/disable saml authentication for a
user
- Stubs to implement saml token flushing/expiry
- CLOUDSTACK-8463:
* Use username attribute specified in global setting
Use username attribute defined by admin from a global setting
In case of encrypted assertion/attributes:
- Decrypt them
- Check signature if provided to check authenticity of message using IdP's
public key and SP's private key
- Loop through attributes to find the username
- CLOUDSTACK-8538:
* Add new global config for SAML request sig algorithm
- CLOUDSTACK-8539:
* Add metadata refresh timer task and token expiring
- Fix domain path and save it to saml_tokens
- Expire hour old saml tokens
- Refresh metadata based on timer task
- Fix unit tests
This closes#489
(cherry picked from commit 20ce346f3a)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Conflicts:
client/WEB-INF/classes/resources/messages_hu.properties
plugins/hypervisors/xenserver/src/com/cloud/hypervisor/xenserver/resource/wrapper/xenbase/CitrixCheckHealthCommandWrapper.java
plugins/user-authenticators/saml2/src/org/apache/cloudstack/api/command/SAML2LoginAPIAuthenticatorCmd.java
ui/scripts/ui-custom/login.js
This makes sure we don't expose CloudStack stacktrace (if any) on the frontend
instead redirect to show an error handling page.
This closes#256
(cherry picked from commit 112cecc2d4)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
As recently discussed on the dev list:
This sorts the domain lists based on their path.
Especially handy when having a lot of domains,
like in a public cloud.
Cherry-picked to 4.5 branch since commit exists in 4.4 and master branch.
(cherry picked from commit befa28251d)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
As recently discussed on the dev list:
This sorts the domain lists based on their path.
Especially handy when having a lot of domains,
like in a public cloud.
1. provide compatibility with the Big Cloud Fabric (BCF) controller
L2 Connectivity Service in both VPC and non-VPC modes
2. virtual network terminology updates: VNS --> BCF_SEGMENT
3. uses HTTPS with trust-always certificate handling
4. topology sync support with BCF controller
5. support multiple (two) BCF controllers with HA
6. support VM migration
7. support Firewall, Static NAT, and Source NAT with NAT enabled option
8. add VifDriver for Indigo Virtual Switch (IVS)
This closes#151
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
Customise the messages showed during VPC restart based on redundancy
Do not show "Make Redundant" option if VPC is already redundant
Show on VPC details if a VPC is redundant
The 19e3c0168e commit breaks SAML login and any
login where redirection is used.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
(cherry picked from commit b79f13ccb5)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
... this change, opening the 2nd browser window (of the same
domain) will show login screen (i.e. user has to enter
credentials again) and will cause the 1st browser window
session timeout.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
(cherry picked from commit 19e3c0168e)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
... this change, opening the 2nd browser window (of the same
domain) will show login screen (i.e. user has to enter
credentials again) and will cause the 1st browser window
session timeout.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
This is a plugin that puts in ovm3 support ranging from 3.3.1 to 3.3.2. Basic
functionality is in here, advanced networking etc..
Snapshots only work when a VM is stopped now due to the semantics of OVM's raw
image implementation (so snapshots should work on a storage level underneath the
hypervisor shrug)
This closes#113
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- UI: use post when updating user
- S3: don't send s3 key in the response
- VPN: don't send preshared key in remoteaccessvpn api response
- Snapshot response should set zone id not volume's device id
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
(cherry picked from commit 02cadc3fb3)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- UI: use post when updating user
- S3: don't send s3 key in the response
- VPN: don't send preshared key in remoteaccessvpn api response
- Snapshot response should set zone id not volume's device id
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- Backend should update if state was diabled and now has changed
- UI's fetch latest does not actually fetch latest
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
(cherry picked from commit 985a61652e)
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- Backend should update if state was diabled and now has changed
- UI's fetch latest does not actually fetch latest
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
UI use xennetworklabel parameter name in zone create Wizards,
in API, it uses xenservernetworklabel,
the parameter name doesn't match, cause network name label not setup in CCP
UI use xennetworklabel parameter name in zone create Wizards,
in API, it uses xenservernetworklabel,
the parameter name doesn't match, cause network name label not setup in CCP
For UI plugin development, allow moving though VM wizard steps via
custom event hook, cloudStack.instanceWizard.showStep (attached to
wizard DOM object), passing the specified target step index
Example:
$wizard.trigger('cloudStack.instanceWizard.showStep', {
index: 2 // Show step 2 of wizard
refresh: true // (Optional) Force refresh of step if data loaded
});
This causes it to fail if that path doesn't begin with '/'. It works fine
while adding primary storage. Added a check to add '/' in begining if needed.
-Places dictionary JSP includes at top of script includes, to help solve
a potential issue where the dictionary may not always be loaded before
the UI initializes
-Places dictionary JSP includes at top of script includes, to help solve
a potential issue where the dictionary may not always be loaded before
the UI initializes
Instead of mapping both dictionary JSP files to separate objects, extend
dictionary2's object onto single 'dictionary' object.
-- The previous approach was causing issues on certain dialogs, which were not
opening due to possible missing labels.
Conflicts:
ui/dictionary2.jsp
Instead of mapping both dictionary JSP files to separate objects, extend
dictionary2's object onto single 'dictionary' object.
-- The previous approach was causing issues on certain dialogs, which were not
opening due to possible missing labels.
In some cases the UI does not display the correct text, displaying 'label.xyz' instead of the localized string.
This appears to be due to the dictionary split: entries in dictionary2.jsp are not found because the dictionary has not been extended with dictionary2 as expected.
In this fix:
- Instead of extending the dictionary, we leave it as it is and change the localization function to look in the dictionary first and, if the item is not found there, then look in dictionary2.
- This way we are not depending on the extent() function to be called at the 'right' time; In turn, the localization function will be aware of both dictionaries.
- In the future, when we add another dictionary, we will have to modify this function only.
Fix List calls in the processing state forever with invalid name
provided with Account name search filter -Added error handling for
Events, Instances, Network, Projects, Storage pages where an advanced
search by an invalid account name was making the UI to show in progress
state forever.
In some cases the UI does not display the correct text, displaying 'label.xyz' instead of the localized string.
This appears to be due to the dictionary split: entries in dictionary2.jsp are not found because the dictionary has not been extended with dictionary2 as expected.
In this fix:
- Instead of extending the dictionary, we leave it as it is and change the localization function to look in the dictionary first and, if the item is not found there, then look in dictionary2.
- This way we are not depending on the extent() function to be called at the 'right' time; In turn, the localization function will be aware of both dictionaries.
- In the future, when we add another dictionary, we will have to modify this function only.
Wrong format check is being made on Create VPC box - DNS domain
Information Removing IPv4 validation from the DNS field, the original
behavior is restored. (The API validates this field.)
- removed duplicate entries in dictionary
- added dictionary entries that have been missed during the dictionary split
- added missing entries in messages.properties
- fixed other localization issues
(cherry picked from commit 0646588fc6)
- replaced all occurrences of "listloadbalancerssresponse" with "listloadbalancersresponse" in ui\scripts\vpc.js, following the change in the listLoadBalancers API response string.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
(cherry picked from commit ea5c8eed0c)
-Removed unused code that was causing javascript exception
Signed-off-by: Brian Federle <brian.federle@citrix.com>
(cherry picked from commit 30611be15a)
- removed duplicate entries in dictionary
- added dictionary entries that have been missed during the dictionary split
- added missing entries in messages.properties
- fixed other localization issues
- replaced all occurrences of "listloadbalancerssresponse" with "listloadbalancersresponse" in ui\scripts\vpc.js, following the change in the listLoadBalancers API response string.
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
-Split 'dictionary.jsp' into two files -> 'dictionary.jsp' and
'dictionary2.jsp' -- this is due to JSP file constraints as the
localization object is getting quite long
-Per change above, 'dictionary' object is now split into an additonal
'dictionary2' object, which is merged with the main dict object on page
load
-All new dictionary mappings should be added to 'dictionary2' now.
Signed-off-by: Brian Federle <brian.federle@citrix.com>
- Preserve the advanced search parameters, so that when the advanced search box is shown again,
it is populated with the values selected/entered previously, unless they have navigated away from the search results page,
or applied any additional filters/search parameters.
Signed-off-by: Mihaela Stoica <mihaela.stoica@citrix.com>
Signed-off-by: Rajani Karuturi <rajanikaruturi@gmail.com>
-Truncate key/name field to prevent long strings from stretching the
table width beyond the container bounds.
-Update min-width for truncated fields for better compatibility
For UI plugin development, add new event
'cloudStack.deployVirtualMachine'
-- This passes the wizard form data and all parameters that will be
passed to deployVirtualMachine; allows plugin to extend data to pass
additonal data automatically (i.e, custom form fields)
This is a feature to handle DNS entries by means of an external DNS Provider,
such as Bind. These entries include DNS domains and reverse domains, VM records
and reverse records.
For a complete description, please refer to the design document available at
https://cwiki.apache.org/confluence/display/CLOUDSTACK/Bind+and+PowerDNS+integration+by+Globo+DNSAPI
For the discussion about this feature on the dev mailing list, please refer to
http://markmail.org/thread/fvwf36hpxotiibka
Summary:
- new Network Service Provider called GloboDNS
- new Network Element to manage network domains and VM records (entries) on an external API
- new Network Resource to communicate with GloboDNS (open source)
- new API command to add DNS server
- new global option to determine if this provider should override VM entries on external DNS server
- changes in UI to include GloboDNS in Providers list
Signed-off-by: Rohit Yadav <rohit.yadav@shapeblue.com>
- Reverted the validator.messages to the original values (jquery.validator.js).
- Added a function to localize validator.messages which is called before login.
Signed-off-by: Brian Federle <brian.federle@citrix.com>
-- Specifically, this fixes issue where secondary IP 'view all' link was
not displaying, due to a change in the rows' CSS naming conventions
in the widget.
In the "SSL Certificate" dialog we added:
- new field for the root certificate;
- a button to add intermediate certificates if necessary; when this is pressed, a new field, called "Intermediate certificate 1" is added; pressed again, "Intermediate certificate 2" field is added, and so on.
We upload the certificates in order: first the root certificate (with id=1), then the intermediate certificates (with id=2,3,..) and finally the server certificate.
When uploading a certificate, we wait for the upload to be completed successfully and only then we proceed to uploading the next one. If one fails, we report failure and don't continue with the remaining.
Signed-off-by: Mihaela Stoica <mihaela.stoica@citrix.com>
Remove extra 'buffer zone' around quick view tooltip. This was
causing misleading behavior in some cases, due to the cursor being
hovered over a different row while another row's quick view was
still open
Evaluates pre-filter for individual actions (i.e., when action.preFilter is specified)
every time a multi-select row is checked orunchecked. This allows multi-select
actions to be shown/hidden on a per-row basis.
Fixes issue where outdated context is passed to subselect's data provider
when infinite scroll event loads more data items. Now, context is derived
from DOM data directly instead of in the args.
Fixes condition where, on 'refresh' of list view, infinite scrolling no longer
works due to leftover state prior to refresh. Now page # and end-of-list
indicator are stores in DOM object, for easier cleanup
Fixes issue where duplicate and/or incorrect list view entries were
being passed due to list view object not being referenced relatively for
multi-select actions, causing more than one list being passed at times.
Adds support for adding preFilter on a per-action basis, to assist in
plugin development. If action.preFilter function is passed, and returns
true/false, the action is shown/hidden. If no preFilter is specified,
then the action will be passed through the detail view's standard filter.
Example:
testAction: {
label: 'Test Action',
...
preFilter: function(args) {
return false; // Action will be hidden
},
...
}
Add event handler on tab change to remove all old tab content. This prevents
potential conflicts with referencing widget data caused by old content laying
around.
Adds 'noPanelView' option for detail view connected to list view. When
specified, don't support opening the detail view in a new browser pane (i.e.,
only render quickview).
If array is passed in field data, render the table cell as a list.
Example:
dataProvider: function(args) {
args.response.success({ data: [ fieldA: ['i1', 'i2', ...] ] })
}
Made changes so that uploading custom certificate works for ssvm.
1. Reboot ssvm only when private key is passed meaning the server cert is passed. This is because while uploading the server cert is the last to be uploaded. And we want to propagate the entire chain once uploading is done.
2. Change the SecStorageSetupCommand sent to ssvm so that it also carries the root cert apart from having the chain and the server cert and key.
3. Change ssvm agent code to be able to configure root cert to the java key store.
4. Change ssvm configure ssl script to insert the chain certs correctly.
5. Fix order of chain certificates for apache webserver in SSVM
6. Remove double encoding and decoding for uploadCustomCertificate API from UI and server code respectively, so that API call without UI works fine
7. Java 1.7 - disable using SNI since copyTemplate doesnt work for SSL.
Adds front-end support to instance wizard UI for service offerings
supporting multiple disks.
The UI changes will show if a list 'multipleDisks: []' is passed with
the disk offering data options.
Added fields to /api and /server classes for CustomDiskOfferingMinSize
to be available in CapabilitiesResponse. Fixed UI code in Instance
Wizard to have this config value as the minimum selectable option when
we are in custom disk size mode.
DetailView widget now supports bool isCopyPaste property that can be set
for fields. If this is set to true, the text of this field is displayed
using ellipsis formatting* and a copy-paste icon is available right next
to it. On clicking this icon, the full text is displayed
*: tooltip is also enabled showing the original non-ellipsed value
-Label recoverVirtualMachine as 'Recover VM'
-Label restoreVirtualMachine as 'Reinstall VM'
-Change confirmation text for restoreVirtualMachine to be more explicit
-Change restoreVirtualMachine icon to 'recycle' symbol, to avoid
confusion with the reboot VM icon
Fixes issue where, if an action is being performed from the quick view in the
'Instances' section, the old context will be passed when viewing instances in
the 'hosts' section, causing all instances to be displayed. This was caused
by the quickview tooltip still being in the DOM, even after closing it by
clicking an action.
CLOUDSTACK-4762 : Enabling VGPU support for XenServer.
This feature is to enable the GPU-passthrough and vGPU functionality,
with the help of this feature, admins/users will be able to leverage
the GPU graphics unit power by deploying a virtul machine with GPU or
vGPU support or by changing the service offering of an existing VM
at any later point of time. There GPU/vGPU enabled VMs are able to run
graphical applications.
For now, this feature is only supported with XenServer hypervisor but
can be extended to add the support of other hypervisors.
Trigger new event 'cloudStack.createForm.makeFields'
before field params are being passed to createForm for rendering.
This allows plugins to change and intepret fields before they are drawn.
Gluster can now be used for Primary Storage just like NFS. This change adds the
Gluster protocol to the Management Server:
Infrastructure -> Primary Storage -> Add Primary Storage
And also add the option to create Primary Storage on Gluster when
following the 'Add Zone' wizard from:
Infrastructure -> Zones -> Add Zone
Some screenshots and verification:
- http://blog.nixpanic.net/2013/12/using-gluster-as-primary-storage-in.html
encoded. This cause createStoragePool or addImageStore command to fail if special
characters were present. Updated the code to pass user, password and domain as part
of details while adding primary or secondary. Also made changes on server side to
handle it.
Fixes case when detail view has an embedded list view with action, that
the action is handled by detail view instead of list view, causing
unexpected behavior
For any plugin/module, allow including additional JS dependencies via
new plugin syntax.
To include JS files, instead of passing a function directly, pass an
array with the first element being a sub-list of the includes:
cloudStack.plugin.myPlugin = [
['file1', 'file2', 'fileN' ...], // These will be loaded before
// plugin is executed
function(plugin) { // The plugin entry point
...
}
];
-- Where each item represents a JS file relative to the plugin folder
and without the .js extension. Sub-folders are also supported, i.e.,
'subfolder/file1'
Removes conditional check of volume state for snapshot action filter,
since it causes a null pointer when trying to access view outside the storage
section. Now only '.revertable' attribute is checked. Storage state should now
be verified at the API level only.
Fixes issue where 'view all' link permanently writes properties to
cloudStack namespace, causing breakage when viewing detail view from
another location.
For section select list views, if 'id' is specied under section: {},
then use that ID instead of the section's key ID. This allows sections
to use i.e. the same ID as each other for a consistent context ID.
This patch adds a network plugin to support Palo Alto Networks firewall (their appliance and their VM series firewall).
More information in the FS: https://cwiki.apache.org/confluence/display/CLOUDSTACK/Palo+Alto+Firewall+Integration
Features supported are:
- List/Add/Delete Palo Alto service provider
- List/Add/Delete Palo Alto network service offering
- List/Add/Delete Palo Alto network with above service offering
- Add instance to the new network (creates the public IP and private gateway/cidr on the PA as well as the source nat rule)
- List/Add/Delete Ingress Firewall rule
- List/Add/Delete Egress Firewall rule
- List/Add/Delete Port Forwarding rule
- List/Add/Delete Static Nat rule
- Supports Palo Alto Networks 'Log Forwarding' profile globally per device (additional docs to come)
- Supports Palo Alto Networks 'Security Profile Groups' functionality globally per device (additional docs to come)
Knowns limitations:
- Only supports one public IP range in CloudStack.
- Currently not verifying SSL certificates when creating a connection between CloudStack and the Palo Alto Networks firewall.
- Currently not tracking usage on Public IPs.
Signed-off-by: Sheng Yang <sheng.yang@citrix.com>
-Support passing isHidden option as closure, for conditional hide/show
based on context
-Adds new option format for isHidden option:
return false == show field and all columns (default)
return true == hide only header and form column
return 2 == hide header and form, as well as returned item column -- these
item columns will be skipped over entirely, not just hidden
-Removes socket display from the main infra. dashboard and onto a
separate page. This is due to performance issues with the API calls
that query each hypervisor's socket data.
-Convert socket display to a list view, for simplicity/consistency.
Due to usability issues, any UI plugins that add a main section (via the
addSection function) will now be shown in the 'Plugins' area by clicking
on the relevant tile. This is to prevent overflow of the side nav bar
caused by too many plugins being loaded.
Rename 'socket info' title to 'hypervisors' to make it more generic, as
the dashboard section contains hypervisor host counts which are useful
in other contexts.
(2)Destroy Instance action: add expunge option for root-admin and domain-admin. When expunge is set to true, instance will be expunged right after destroyed.
-For better screen real-estate, make all
browser panes open to full width of content area by default, unless
partial: true is passed in options
-Remove animation effect, for quicker browsing
(2) Edit Template action: make 'XenServer Tools Version 6.1+' field editable and use addResourceDetail API to update it.
(3) Edit Instance action: make 'XenServer Tools Version 6.1+' field editable and use addResourceDetail API to update it.
commit c9ee0d12e191e803fb341f3f96e95ca434a36f6c
Author: Wei Zhou <w.zhou@leaseweb.com>
Date: Wed Oct 23 16:55:10 2013 +0200
CLOUDSTACK-4931, CLOUDSTACK-4937: setDetails to user VMs only
(cherry picked from commit a94acc5a43)
commit fe1586c71377bc6d219db2dcf088c40b65dd1fc4
Author: Anthony Xu <anthony.xu@citrix.com>
Date: Tue Oct 22 11:20:27 2013 -0700
CLOUDSTACK-4649:
vm sync tracks the pv driver version for xenserver
Anthony
commit 56a218f66eda540b4b4b04030ee71fc6863f8532
Author: Anthony Xu <anthony.xu@citrix.com>
Date: Mon Oct 21 16:10:07 2013 -0700
CLOUDSTACK-4649:
xs 6.1/6.2 introduce the new virtual platform, so there are two virtual platforms, windows PV driver version must match virtual platforms,
this patch tracks PV driver versions in vm details and template details.
Anthony
commit 4e85d28c678a6f96b5b70d8d33fc60f9d1ea3df6
Author: Laszlo Hornyak <laszlo.hornyak@gmail.com>
Date: Mon Oct 21 21:17:33 2013 +0200
removed unused static field
- s_httpClientManager was not used
Signed-off-by: Laszlo Hornyak <laszlo.hornyak@gmail.com>
commit d4121fa26023db236f7396cea455ef090672ae9a
Author: Chris Suich <chris.suich@netapp.com>
Date: Tue Oct 22 10:45:22 2013 -0400
Updated DataMotionServiceImpl and ApiResponseHelper based on review feedback.
commit aaf026e1e4204d405bcda2ae4f1a01b1d0f7e7cb
Author: Chris Suich <chris.suich@netapp.com>
Date: Thu Oct 17 14:27:12 2013 -0400
Added context to strategy sorting error responses
Added TODOs for DRYing out pickStrategy() overloading
commit a221f4aa3fb2ddc255bc35cf753f98f88f5bf44e
Author: Chris Suich <chris.suich@netapp.com>
Date: Wed Oct 16 09:57:28 2013 -0400
Updated inefficient strategy sorting/selection
Removed unnecessary canRevertSnapshot from PrimaryDataStoreDriver
Other general cleaup and fixes from reviews
commit 7d58949c6a1b7e853e891b59387a9620e8cd7a91
Author: Chris Suich <chris.suich@netapp.com>
Date: Mon Oct 14 14:01:22 2013 -0400
Added volume snapshot revert capability to SnapshotResponse
Updated UI to hide/show snapshot revert action per snapshot
Signed-off-by: Edison Su <sudison@gmail.com>
Initial patch for VXLAN support.
Fully functional, hopefully, for GuestNetwork - AdvancedZone.
Patch Note:
in cloudstack-server
- Add isolation method VXLAN
- Add VxlanGuestNetworkGuru as plugin for VXLAN isolation
- Modify NetworkServiceImpl to handle extended vNet range for VXLAN isolation
- Add VXLAN isolation option in zoneWizard UI
in cloudstack-agent (kvm)
- Add modifyvxlan.sh script that handle bridge/vxlan interface manipulation script
-- Usage is exactly same to modifyvlan.sh
- BridgeVifDriver will call modifyvxlan.sh instead of modifyvlan.sh when VXLAN is used for isolation
Database changes:
- No change in database structure.
- VXLAN isolation uses same tables that VLAN uses to store vNet allocation status.
Known Issue and/or TODO:
- Some resource still says 'VLAN' in log even if VXLAN is used
- in UI, "Network - GuestNetworks" dosen't display VNI
-- VLAN ID field displays "N/A"
- Documentation!
Signed-off-by : Toshiaki Hatano <haeena@haeena.net>
If VSM is active, and either traffic overrides are checked, make VSM
fields required.
** This creates new VSM fields, with '_req' appended to end of ID. API
calls need to be changes to account for this.
Adds a new dialog field type called 'has_units'. This field has an
input box side by side with a select box. The select box is populated
with predefined units (MB, GB, TB, for example) and uses (also
predefined) conversion functions to allow automatic updating of the
input box value when the units select box is changed.
Original author: Chris Suich <chris.suich@netapp.com>
Reviewed by: Brian Federle <brian.federle@citrix.com>
Example:
fields: {
...
size: {
...
has_units: true,
units: [
{
id: 'gb',
text: 'GB',
fromBase: function(val) { ... return val; },
toBase: function(val) { ... return val; }
},
...
]
}
}
Allows UI plugins to contribute their own internationalized strings to
the global js dictionary. Each plugin would define a dictionary.js and
several dictionary_<locale>.js files. As each plugin is loaded, the
appropriate plugin dictionary is loaded into the global js
dictionary (with the global dictionary taking precedence in the event
of a conflict).
Original author: Chris Suich <chris.suich@netapp.com>
Reviewed by: Brian Federle <brian.federle@citrix.com>
If 'selectedObjNonEditable' option is passed alongside 'selectedObj'
on response, make checkbox selection readonly/disabled.
Right now this is to support 'required' affinity group selections that
shouldn't be unselected.
When adding an S3 secondary storage, the administrator will
now be shown help for each input field making it friendlier
to use.
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
(cherry picked from commit 74643c9561b1ea564f180c3780ef762e97e7c10b)
Support passing list of dependsOn targets for form fields. This will
trigger a change if any items specified in list are changed.
Example:
fieldA: {...},
fieldB: {...},
fieldC: { dependsOn: ['fieldA', 'fieldB'] }
Re-number dragged items in increments of ten, and use an average of
the previous and next number, so that multiple reorders can occur
before conflicts happen.
Now that scaleVirtualMachine is being used to change compute
offerings, the old 'change service' action can be removed, as it will
be deprecated in the future.
Fixes potential issue where plugins could load after cloudStack UI is initialized,
preventing their functionality from showing up.
Now, the main UI is only loaded after all plugins have loaded; this is via
'cloudStack.pluginReady' event.
zoneWizard.js puts field name and value twice where we need only
and css padding overflows in some browser rendering. The result is
that isolation method pull down menu will be pushed down and hidden
under the next box element.
Stratosphere SSP is an SDN solution which creates virtual L2
networks backed by vxlan and vlan. SSP will ask hypervisor to set a
specific vlan, then SSP will interact with openflow switches and
put vxlan/vlan translation flow rules.
This plugin provides SSP as "connctivity" service provider.
Signed-off-by: Hiroaki KAWAI <kawai@stratosphere.co.jp>
For larger forms, if 'bigSize' is specified in form options, dialog
will widen to a 2-column layout. This is to prevent the form fields
from going off the bottom of the screen.
Several new fields were causing disk offering list view to
overflow. These were removed from the table listing, and are still
viewable from the detail page.
For cases such as in global setting values, truncate long text if new
option 'truncate: true' is specified in field properties. This will
reduce td's max-width and add ellipses. Edit field on truncate: true
columns will overflow into action column, to prevent input area from
being too cramped.
1.Dynamically add newly created project to dropdown list
2.Return to default view if a user deletes the same project in project view
Modified: ui/scripts/projects.js
Modified: ui/scripts/ui-custom/projects.js
Japanese properties file was broken, fixed manually.
We need to let the servlet container the encoding to use.
Signed-off-by: Hiroaki KAWAI <kawai@stratosphere.co.jp>
For fresh install, adds hook to install wizard UI to show a custom
'step' before the initial welcome screen.
Pre-install specified by providing 'cloudStack.preInstall,' which
returns a jQuery object to be displayed. It passes args.complete,
which when called will proceed to the first step of the install
wizard.
- Remove 'Port forwarders' -- Getting IPs by PF is not supported by API
- Split Public + Internal LB into separate items
- Use API response 'count' for count number, instead of array
'.length' to fix issues with larger results
Adds a new dialog 'cloudStack.dialog.listView'
-- Supports displaying a list view in a popup dialog, for selecting
items for an action (i.e., selecting VMs for an LB rule). Arguments
are a list view object and the 'type' of selection: either
'checkbox' or 'radio'
Example:
detailView: {
name: 'Internal Lb details',
actions: {
assignVm: {
label: 'Assign VMs to LB',
messages: {
notification: function(args) { return 'Assign VM to internal LB rule'; }
},
listView: $.extend(true, {}, cloudStack.sections.instances.listView, {
type: 'checkbox',
filters: false
}),
action: function(args) {
args.response.success();
},
notification: {
poll: function(args) {
args.complete();
}
}
}
},
...
}
add xenserver support in UI
only XenServer and KVM clusters are allowed in security enabled zone.
only shared security enabled networks are allowed in security enabled zone.
Squashed commit of the following:
commit def0861d5a
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu May 9 10:53:09 2013 -0700
Inernallb: added internalLbVm to the list of network elements for nonoss build
commit 56d94fc074
Merge: d828c158f9a42e
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu May 9 09:51:36 2013 -0700
Merge branch 'master' into internallb1
Conflicts:
plugins/network-elements/netscaler/src/com/cloud/network/element/NetscalerElement.java
server/src/com/cloud/network/vpc/VpcManagerImpl.java
commit d828c154fd
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed May 8 14:58:22 2013 -0700
internallb: Fixed nonoss build
commit 1b8a6986a6
Merge: 9e74fa9738d35a
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed May 8 13:20:07 2013 -0700
Merge branch 'master' into internallb1
Conflicts:
api/src/com/cloud/async/AsyncJob.java
api/src/com/cloud/network/NetworkModel.java
api/src/com/cloud/network/rules/LoadBalancerContainer.java
api/src/org/apache/cloudstack/api/BaseCmd.java
api/src/org/apache/cloudstack/api/ResponseGenerator.java
api/src/org/apache/cloudstack/network/lb/ApplicationLoadBalancerContainer.java
client/tomcatconf/commands.properties.in
engine/schema/src/com/cloud/network/dao/LoadBalancerDaoImpl.java
server/src/com/cloud/api/ApiResponseHelper.java
server/src/com/cloud/network/NetworkManagerImpl.java
server/src/com/cloud/network/NetworkModelImpl.java
server/src/com/cloud/network/NetworkServiceImpl.java
server/src/com/cloud/server/ManagementServerImpl.java
server/test/com/cloud/network/MockNetworkModelImpl.java
server/test/com/cloud/vpc/MockNetworkManagerImpl.java
server/test/com/cloud/vpc/MockNetworkModelImpl.java
server/test/resources/appLoadBalancer.xml
setup/db/db/schema-410to420.sql
test/integration/component/test_multiple_ip_ranges.py
test/integration/smoke/test_guest_vlan_range.py
tools/marvin/marvin/integration/lib/base.py
commit 9e74fa9406
Author: Prasanna Santhanam <tsp@apache.org>
Date: Thu May 9 00:11:40 2013 +0530
marvin changes for internallbvm provider
- changed the simulator context to load the internallb bean
- fixed deployDataCenter to use the additional provider by default
- fixed the sandbox script and the setup script for simulator checkin
tests
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 0a2d49301b
Author: Jessica Wang <jessicawang@apache.org>
Date: Tue May 7 15:50:41 2013 -0700
Internal LB - UI - zone wizard - advanced zone - enable internal LB element, enable internal LB provider.
commit 43e1667f90
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue May 7 13:26:53 2013 -0700
Moved all DAOs and VOs to the cloud-engine-schema project
commit 2fd94c8bbe
Author: Radhika PC <radhika.puthiyetath@citrix.com>
Date: Tue May 7 18:26:08 2013 +0530
CLOUDSTACK-893 api
commit 12b64d6c00
Author: Prasanna Santhanam <tsp@apache.org>
Date: Tue May 7 17:06:15 2013 +0530
Fixing the gmaven configuration for marvin/pom.xml
For the marvin checkin test custom properties had a typo when run for
the *nix environment.
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 1e4274dd9f
Author: Prasanna Santhanam <tsp@apache.org>
Date: Tue May 7 15:28:43 2013 +0530
Renaming TesDedicateVlanRange -> TestDedicateVlanRange
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 9264ac526f
Author: Prasanna Santhanam <tsp@apache.org>
Date: Tue May 7 15:28:20 2013 +0530
Adding isolation method to the zone creation of marvin
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 3a0dc67de0
Author: Prasanna Santhanam <tsp@apache.org>
Date: Tue May 7 15:27:26 2013 +0530
adding ACL for dedicateGuestVlanRange set of APIs
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 79f6e11368
Author: Prasanna Santhanam <tsp@apache.org>
Date: Tue May 7 15:26:48 2013 +0530
add debug logs when access checkers fail to find API
When the access checkers fail for api discovery, we fail silently.
instead record a debug message.
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 92cb7d3e0f
Author: Hugo Trippaers <trippie@gmail.com>
Date: Tue May 7 11:44:23 2013 +0200
commit e0d8f01ecd enabled all tests. Fix
AWSAPI build by removing broken tests and excluding failing tests.
commit 4a391464c7
Author: Hugo Trippaers <htrippaers@schubergphilis.com>
Date: Tue May 7 10:57:23 2013 +0200
commit e0d8f01ecd enabled all tests, but the tests in vmware-base are horribly broken and will not compile with the current CloudStack.
Removing the tests to fix the nonoss build and they are so broken they should be rewritten from scratch anyway.
commit 2ca03a8513
Author: Prasanna Santhanam <tsp@apache.org>
Date: Tue May 7 13:51:34 2013 +0530
moving test data to top level dictionary
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit ceaa4e1b0d
Author: Prasanna Santhanam <tsp@apache.org>
Date: Tue May 7 13:50:56 2013 +0530
Adding tracelogs to the API discovery service
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit a3f5f01c7e
Author: Prasanna Santhanam <tsp@apache.org>
Date: Tue May 7 13:50:12 2013 +0530
dedicateGuestVlanRange is admin only API
Adding ACL for the dedicateGuestVlanRange API.
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 1c4c80fe91
Author: Hugo Trippaers <htrippaers@schubergphilis.com>
Date: Tue May 7 09:58:16 2013 +0200
Recent pom switcharoo caused the client to lose the dependecy on console-proxy, which it needs to include the systemvm
commit 8103f3c386
Author: Radhika PC <radhika.puthiyetath@citrix.com>
Date: Tue May 7 11:30:17 2013 +0530
CLOUDSTACK-893 first cut
commit 67d0411d73
Author: Dave Cahill <dcahill@midokura.com>
Date: Fri Apr 19 17:31:44 2013 +0900
Add docs for MidoNet networking plugin [CLOUDSTACK-996]
Signed-off-by: Dave Cahill <dcahill@midokura.com>
commit c745e6d28e
Author: Alex Huang <alex.huang@gmail.com>
Date: Mon May 6 16:34:03 2013 -0700
Fixed up the simulator to run with windows paths in cygwin
commit be91c03702
Author: Alex Huang <alex.huang@gmail.com>
Date: Mon May 6 10:34:22 2013 -0700
Moved over the VLAN daos
commit dcc09f8472
Author: Alex Huang <alex.huang@gmail.com>
Date: Mon May 6 06:31:47 2013 -0700
Missing file and updated .gitignore
commit e9953cd1a8
Author: Alex Huang <alex.huang@gmail.com>
Date: Mon May 6 06:29:59 2013 -0700
Fixed up unit testing to use only an in class TestConfiguration
commit 6727571403
Author: Alex Huang <alex.huang@gmail.com>
Date: Thu May 2 15:20:49 2013 -0700
Fixed an incorrect unit test for affinity group. Removed some useless pom.xml.
commit d015fb3520
Author: Alex Huang <alex.huang@gmail.com>
Date: Thu May 2 06:50:38 2013 -0700
Moved most of the VOs and DAOs from server package into engine-schema as well
commit 77547a58df
Author: Alex Huang <alex.huang@gmail.com>
Date: Wed May 1 15:15:57 2013 -0700
Removed files that are no longer used and further separated out the files in the core project
commit 345f3d3482
Author: Alex Huang <alex.huang@gmail.com>
Date: Wed May 1 05:46:15 2013 -0700
Moved agent commands to core and out of api
commit e91ca00571
Author: Alex Huang <alex.huang@gmail.com>
Date: Tue Apr 30 19:06:20 2013 -0700
Removed framework-api which is completely useless. Changed framework-ipc to reference gson itself. Move VOs into engine-schema.
commit f64564e490
Author: Dennis Lawler <dlawler@gmail.com>
Date: Mon Apr 29 15:10:09 2013 -0700
Removing filterwin2k option
Signed-off-by: Chiradeep Vittal <chiradeep@apache.org>
commit 944a7ea5d6
Author: Wei Zhou <w.zhou@leaseweb.com>
Date: Mon May 6 20:57:02 2013 +0100
CLOUDSTACK-2319: fix "unable to add egress rules" in SecurityGroup
Signed-off-by: Chip Childers <chip.childers@gmail.com>
commit ff7f8ba362
Author: Wei Zhou <w.zhou@leaseweb.com>
Date: Mon May 6 20:56:06 2013 +0100
CLOUDSTACK-2322: update network.gateway to fix deployVm error on
SharedNetwork after ipv6 support
Signed-off-by: Chip Childers <chip.childers@gmail.com>
commit a153373c7e
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon May 6 11:45:19 2013 -0700
CLOUDSTACK-129: added new API - listNetworkIsolationMethods - for displaying isolation methods supported by the cloudStack
commit 46f59cd49e
Author: Prasanna Santhanam <tsp@apache.org>
Date: Mon May 6 20:39:36 2013 +0530
Fixed the incorrect assertion in noncontiguous_vlan test
The assertion fails if the VLAN is found in which case find returns a
positive number. So here the assertion should infact assert < 0 result.
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit bd1dcc10b3
Author: Prasanna Santhanam <tsp@apache.org>
Date: Mon May 6 19:53:42 2013 +0530
Affinity Groups requires multiple storage pools
Fixing the affinity group test which would fail to find the appropriate
storage pool to satisfy the anti-affinity group of the second VM
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 7f853cdb8f
Author: Prasanna Santhanam <tsp@apache.org>
Date: Mon May 6 19:16:15 2013 +0530
fixing double calls to VM deploy
This fixes regression introduced in commit 2f40a90c that made duplicate
calls to deployVirtualMachine.
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 646e810fcf
Author: Prasanna Santhanam <tsp@apache.org>
Date: Mon May 6 18:51:53 2013 +0530
fixing wildcard imports
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit b29b6e8525
Author: Hugo Trippaers <htrippaers@schubergphilis.com>
Date: Fri May 3 14:03:53 2013 +0200
BigSwitch should only respond if it is the actual provider on the network.
This fixes an NPE during the release call.
commit 6fcc9b009b
Author: Hugo Trippaers <htrippaers@schubergphilis.com>
Date: Thu May 2 17:38:27 2013 +0200
Prevent Nicira NVP tags from exceeding the 40 character limit.
commit d8e61a1c0a
Author: Sanjay Tripathi <sanjay.tripathi@citrix.com>
Date: Thu May 2 13:45:39 2013 +0530
CLOUDSTACK-2188 : Parsing error with Download Monitor while checking the health of downloaded templates
Signed-off-by: Sateesh Chodapuneedi <sateesh@apache.org>
commit 5b6e1140f9
Author: Sebastien Goasguen <runseb@gmail.com>
Date: Mon May 6 05:35:58 2013 -0400
CLOUDSTACK-2339: Adding libcloud example
commit 7be62d2374
Author: Sebastien Goasguen <runseb@gmail.com>
Date: Mon May 6 05:35:19 2013 -0400
CLOUDSTACK-2338: Adding example of how to sign api requests in python
commit 156fd68902
Author: Talluri <Srikanteswararao.Talluri@citrix.com>
Date: Fri May 3 23:11:56 2013 +0530
CLOUDSTACK-2323: fix test scripts to conform with library changes
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 33ff5e9107
Author: sanjeevneelarapu <sanjeev.neelarapu@citrix.com>
Date: Tue Apr 30 20:09:46 2013 +0530
CLOUDSTACK-702: Tests for Multiple IP Ranges
1.Deleting IP Range from the existing CIDR
2.Add non-contiguous guest IP range in new CIDR
3.Add overlapped guest IP range in existing CIDR
Signed-off-by: sanjeevneelarapu <sanjeev.neelarapu@citrix.com>
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
commit 33059d1f66
Author: Pranav Saxena <pranav.saxena@citrix.com>
Date: Mon May 6 14:08:40 2013 +0530
scaleUp VM response change corresponding UI changes
commit 92e18d8106
Author: Pranav Saxena <pranav.saxena@citrix.com>
Date: Mon May 6 13:45:32 2013 +0530
CLOUDSTACK-2337:Resize button available for root/domain admin and normal users
commit d5cd3f7e00
Author: Likitha Shetty <likitha.shetty@citrix.com>
Date: Wed May 1 13:47:26 2013 +0530
Dedicate guest vlan range to account
commit 12c79c8377
Author: Pranav Saxena <pranav.saxena@citrix.com>
Date: Sun May 5 12:02:32 2013 +0530
scale up virtual machine response change in the backend
commit 94bac27622
Author: Rohit Yadav <bhaisaab@apache.org>
Date: Sun May 5 09:58:04 2013 +0530
appliance: Upgrade systemvm appliance from rc1 to Debian7 GA
Signed-off-by: Rohit Yadav <bhaisaab@apache.org>
commit c598bb0038
Author: Isaac Chiang <isaacchiang@gmail.com>
Date: Sun May 5 01:57:35 2013 +0530
CLOUDSTACK-2076:Listview widget infinte scrolling error
commit d0615ea9a1
Author: Pranav Saxena <pranav.saxena@citrix.com>
Date: Sun May 5 01:15:14 2013 +0530
CLOUDSTACK-2274:Detail view loading problem when deleting a zone
commit 733b513c3a
Author: Isaac Chiang <isaacchiang@gmail.com>
Date: Sat May 4 13:41:02 2013 +0530
CLOUDSTACK-2160:Refresh button functionality for security groups and statistics tab
commit 418d75d7a4
Author: Marcus Sorensen <marcus@betterservers.com>
Date: Fri May 3 14:09:52 2013 -0600
Summary: Release old DHCP entries
Detail: Refresh dnsmasq with updated entries live, no outage
BUG-ID: CLOUDSTACK-2299
Submitted-by: Dennis Lawler <dlawler@gmail.com>
Signed-off-by: Marcus Sorensen <marcus@betterservers.com> 1367611792 -0600
commit b3dce64577
Author: Kelven Yang <kelveny@gmail.com>
Date: Tue May 7 10:57:19 2013 -0700
fix unitest
commit b17885f0f6
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue May 7 09:55:47 2013 -0700
InternalLb: some fixes to the unittest
commit 1cff609347
Merge: 053e184a3a5c13
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri May 3 11:23:08 2013 -0700
Merge branch 'master' into internallb1
Conflicts:
server/src/com/cloud/network/NetworkModelImpl.java
server/src/com/cloud/network/NetworkServiceImpl.java
server/src/com/cloud/server/ManagementServerImpl.java
server/test/com/cloud/network/MockNetworkManagerImpl.java
server/test/com/cloud/vpc/MockNetworkManagerImpl.java
commit 053e18454d
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri May 3 11:07:07 2013 -0700
InternalLB: marvin integration test for internal lb feature
commit 2e8e2f98f5
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed May 1 13:53:20 2013 -0700
InternalLB: don't allow to upgrade the network from the network offering with internal LB to the offering with public LB, and vice versa
commit c773d204c8
Author: Chiradeep Vittal <chiradeep@apache.org>
Date: Wed May 1 13:21:52 2013 -0700
Internal LB: if we detect that we are inside an internal lb vm, call out to the ilb script to perform LB configuration
Signed-off-by: Chiradeep Vittal <chiradeep@apache.org>
commit 8c8845bf77
Merge: 7e95545471ca30
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed May 1 10:14:06 2013 -0700
Merge branch 'master' into internallb1
commit 7e9554596f
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed May 1 10:01:16 2013 -0700
InternalLb: boot args parameters cleanup for the internal lb vm
commit b7cf870074
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 30 10:31:28 2013 -0700
InternalLb: more unittests for internal lb element
commit 63bb98ebe2
Author: Chiradeep Vittal <chiradeep@apache.org>
Date: Mon Apr 29 18:29:25 2013 -0700
allow ssh on eth1
Signed-off-by: Chiradeep Vittal <chiradeep@apache.org>
commit ca1c313c29
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 29 17:58:45 2013 -0700
InternalLb: DB upgrade - update existing physical networks with InternalLbVm provider
commit ed50caa01c
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 29 17:48:36 2013 -0700
InternalLbVM: handle the scenario when sourceIpAddress is not passed when create internal Lb rule
commit 4c22c911a9
Author: Chiradeep Vittal <chiradeep@apache.org>
Date: Mon Apr 29 15:56:00 2013 -0700
backend support for Internal LB
Signed-off-by: Chiradeep Vittal <chiradeep@apache.org>
commit 7b24a7640c
Merge: 440e848a0dbf89
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 29 15:49:48 2013 -0700
Merge branch 'master' into internallb1
Conflicts:
server/src/com/cloud/api/ApiResponseHelper.java
server/src/com/cloud/api/query/QueryManagerImpl.java
server/src/com/cloud/configuration/ConfigurationManagerImpl.java
server/src/com/cloud/network/NetworkManagerImpl.java
server/src/com/cloud/network/firewall/FirewallManagerImpl.java
setup/db/db/schema-410to420.sql
commit 440e8484d6
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 29 13:27:06 2013 -0700
InternalLB: unittests for InternalLoadBalancerVMManager
commit 63babe4b7e
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri Apr 26 13:44:01 2013 -0700
InternalLb:
1) Added unittests for InternalLoadBalancerVMService
2) Added unittests for InternalLoadBalancerElementService
commit 4f9c47ce54
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 25 14:46:42 2013 -0700
InternalLb: create internal lb vm specific service offering
commit 408ee59d1f
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed Apr 24 17:08:08 2013 -0700
Internallb: new set of Web services APIs for managing Internal LB VMs
commit 7680e1cc10
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed Apr 24 17:08:08 2013 -0700
Internallb:
1) InternalLb and PublicLb can't be enabled on the same network offering
2) Can have internalLb only on VPC tier
commit d73ca7ef73
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed Apr 24 13:02:32 2013 -0700
InternalLb:
1) fixed the bug when the guest nic on internal lb vm wasnt set to be default
2) Don't send the rules to the internal lb vm if its in Stopped state
commit ca2fc30655
Merge: 805756704a2b2d
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 23 16:56:11 2013 -0700
Merge branch 'master' into internallb1
Conflicts:
server/src/com/cloud/network/vpc/VpcManagerImpl.java
server/src/com/cloud/server/ManagementServerImpl.java
setup/db/db/schema-410to420.sql
commit 8057567aaa
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 23 13:15:36 2013 -0700
Internallb: more unittests for ApplicationLoadBalancerService
commit 35c0273b85
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri Apr 19 16:17:45 2013 -0700
InternalLb: unittests for ApplicationLoadBalancerService
commit 69b23f7003
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 18 14:01:10 2013 -0700
InternalLb: create/configure/listInternalLoadBalancerElement - fixes to the API response
commit a3321ce617
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 18 13:31:16 2013 -0700
Internal LB : renamed the classes responsible for managing internal lb elements. Now the names are InternalLoadBalancerVMManager, InternalLoadBalancerVMService and InternalLoadBalancerVMManagerImpl
commit 2baf7c365c
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 18 10:02:17 2013 -0700
Internallb: verify requested IP for LB rule (if specified) against guest network cidr
commit 0cfe96bd00
Merge: 501f2ff11162f5
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed Apr 17 15:41:51 2013 -0700
Merge branch 'master' into internallb1
Conflicts:
api/src/com/cloud/network/IpAddress.java
server/src/com/cloud/network/NetworkServiceImpl.java
setup/db/db/schema-410to420.sql
commit 501f2ffa0b
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 16 17:03:50 2013 -0700
InternalLb: validate source ip network as a part of LB rule creation
commit 4d9a7dfd85
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 16 16:03:32 2013 -0700
InternalLB: in VPC, restrict public LB to one tier only. Internal LB can be supported on multiple tiers
commit 8689bf9eb3
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 16 15:59:56 2013 -0700
Internal LB: added internal lb vm to the list of supported providers in VPC default offering
commit b7709b89ff
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 16 11:04:22 2013 -0700
Internal Lb: added 2 boolean fields - internal_lb and public_lb - to the network offering. Define if internal or public LB service is supported. In the current release it's either one or another; in the future releases we might support both on the same network
commit 014689e45e
Merge: b3b16ba90e8158
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 16 09:55:45 2013 -0700
Merge branch 'master' into internallb1
Conflicts:
api/src/com/cloud/network/Network.java
plugins/network-elements/f5/src/com/cloud/network/element/F5ExternalLoadBalancerElement.java
server/src/com/cloud/network/NetworkManagerImpl.java
server/src/com/cloud/network/NetworkServiceImpl.java
server/test/com/cloud/network/MockNetworkManagerImpl.java
server/test/com/cloud/vpc/MockNetworkManagerImpl.java
setup/db/db/schema-410to420.sql
commit b3b16bae48
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 15 17:00:31 2013 -0700
InternalLB: allow to specify more than one provider for the LB service when create network offering as diff providers can support internal and public LB for the same network
commit a4fc1d7d65
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 15 13:45:25 2013 -0700
Internal LB:
1) Added network_offering_details DB table and corresponding VO/DAO objects. Change createNetworkOffering web services api to accept the map of key/value pairs as details.
2) Allow to have multiple providers for the same service for the network to support the case when LB service can have separate providers for Internal LB and Public LB
commit 4530cebf2b
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 15 10:06:10 2013 -0700
InternalLbVm: support for start/stop Internal lb vm
commit ae69f0ae56
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri Apr 12 17:25:02 2013 -0700
InternalLb: fixed prepare() in InternalLbElement - have to prepare nics of User vms only
commit 888a83c221
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri Apr 12 15:58:27 2013 -0700
InternalLb: Start/deploy internal LB vms for the existing LB rules as a part of network implement
commit 3b41d5bee1
Merge: bb735314b1a9f1
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri Apr 12 15:32:40 2013 -0700
Merge branch 'master' into internallb1
Conflicts:
server/src/com/cloud/network/NetworkModelImpl.java
server/src/com/cloud/server/ManagementServerImpl.java
commit bb73531fed
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri Apr 12 15:13:55 2013 -0700
Internal Lb: list internal lb vms as a part of listRouters response. Introduced new parameter - role (can be virtual_router or internal_lb_vm)
commit c113ea184b
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri Apr 12 12:00:09 2013 -0700
Add Internal Lb Provider/Element as a part of adding a physical network
commit 78c9db79da
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri Apr 12 10:05:28 2013 -0700
InternalLbVm: destroy the internal lb vm when the last rule for the ip is being revoked
commit af6201257b
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 11 16:55:37 2013 -0700
Internal LB: fixed some bugs in internal lb vm startup process
commit 1db240c2b6
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 11 14:23:55 2013 -0700
InternalLb: fixed searchCriteria constructor in ApplicationLoadBalancerDaoImpl
commit 3795048fcc
Merge: f4c2b535f8a278
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 11 14:09:31 2013 -0700
Merge branch 'master' into internallb1
Conflicts:
api/src/com/cloud/async/AsyncJob.java
api/src/org/apache/cloudstack/api/ApiConstants.java
api/src/org/apache/cloudstack/api/BaseCmd.java
api/src/org/apache/cloudstack/api/ResponseGenerator.java
client/tomcatconf/commands.properties.in
server/src/com/cloud/api/ApiDBUtils.java
server/src/com/cloud/api/ApiResponseHelper.java
server/src/com/cloud/server/ManagementServerImpl.java
setup/db/db/schema-410to420.sql
commit f4c2b53c21
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 11 13:46:47 2013 -0700
InternalLB: modified InternalLbElement to start the Internal Lb vm for each ip address (if not already started)
commit 76a4b1cf81
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 11 11:41:47 2013 -0700
InternalLB: added logic for acquiring guest ip address for the Internal LB rule
commit 915e39fbaa
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 11 10:19:18 2013 -0700
Removed unused methods doing ipAllocation from GuestNetworkGuru and NetworkServiceImpl. The correct method is located in NetworkModelImpl
commit 3f2a62c7f6
Merge: 20beb7aa0b5ebc
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed Apr 10 17:16:07 2013 -0700
Merge branch 'master' into internallb1
commit 20beb7a16c
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed Apr 10 15:28:12 2013 -0700
Internal LB: applyLoadBalancerRules - put not null check for sourceIpAddressId (can be null when Schema is not Public)
commit 87e5f5b9a6
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Wed Apr 10 15:17:58 2013 -0700
Internal LB: intermediate checkin - added InternalLBAppliance manager and managerImpl
commit 53b9c0d142
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 9 17:55:10 2013 -0700
Internal LB: added @Since to API docs for Internal LB related commands
commit 867b305ea8
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 9 17:51:19 2013 -0700
Internal LB: Made InternalLbElement to extend the ip deployer as the LB service implements IPDeployerRequester
commit 7b9af28094
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 9 15:45:30 2013 -0700
InternalLb: new set of Web Services APIs to add InternalLB as a network element to the cloudStack (the element is packaged as an independent plugin). New APIs:
1) configureInternalLoadBalancerElement
2) createInternalLoadBalancerElement
3) listInternalLoadBalancerElements
commit 039e303d4a
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 9 14:01:11 2013 -0700
InternalLB: Modified pluggable service VirtualRouterElementService to accept only VirtualRouter and VpcVirtualRouter as a VirtualRouterProvider type when add/configure elements. Other VirtualRouterProviderTypes are are taken care by elb/internal lb plugins.
commit f0018b4512
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Tue Apr 9 12:56:42 2013 -0700
Internal LB:
1)Added InternalLoadBalancerManager and corresponding Impl
2)Add InternalLbVm as a default CS provider. DB upgrade is covered as well
commit e344cf250a
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 8 16:57:47 2013 -0700
InternalLB - removed unused code from LoadBalancerDao
commit 3588f46848
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 8 16:23:03 2013 -0700
Internal LB - added network-element plugin for internal lb service
commit 76325e6168
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 8 13:58:08 2013 -0700
Internal Lb:
1) When network has both kinds of LB rules - Public and Internal - never send them in the same set to the provider
2) Added extra checks on the provider side to validate if the schema - Public or Internal - is supported.
commit 56c2fe1d37
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 8 12:34:59 2013 -0700
InternalLB:
1) Added new capability for the LB service - LbSchemes. Can take 2 values - Internal and Public.
2) F5 and Netscaler LB providers - changes all LB related methods to accept LoadBalancingRule instead of ? extends FirewallRule.
commit 34bcb2d026
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Mon Apr 8 12:11:11 2013 -0700
InternalLB: implemented list/delete/create web services API commands that will be used for Internal LB creation
commit 9ab31e11f7
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Fri Apr 5 15:59:55 2013 -0700
InternalLB: change LoadBalancingRule - reference sourceIpAddress of th load balancer by its value, not DB id
commit 08f855d4e4
Author: Alena Prokharchyk <alena.prokharchyk@citrix.com>
Date: Thu Apr 4 09:26:21 2013 -0700
InternalLB:
1) Added new set of Interfaces - including the new VO - for the internal load balancer
2) DB change - added source_ip_address/source_ip_address_network_id/scheme (Internal/Public) fields to the load_balancer table
-Make new provider 'VNMC' instead of 'ASA1000v'
-Add helper function to add new VNMC managed devices to module
-Make ASA1000v device listing as a view all link under VNMC
For use with plugin API, if 'appendData' is passed in args, always
append this data to the end of the API call. Used when plugin adds new
attributes that need to be passed via the API.
Add new method 'infrastructure.resource' for retrieving resource
objects from the infrastructure section. Specify the type as a
string (i.e, 'pod' 'cluster' or 'host') and the entire resource object
will be returned, including listView, actions, createForm,
etc. Updating the data in this resource will automatically update the
UI.
-Add 'add service provider' module to assist with creating a new
service provider UI
-Add required functionality to append service provider to hardcoded list
-Add basic ASA 1000v provider to list (name, id, state)
-Fixes issue with load order, where plugin's initialization function were not called
in order of the list
-Refactor so that modules and plugins are loaded via the same block,
to avoid redundant code
-Load modules before plugins
Add a variant to a plugin, called a 'module.' It is designed for
features that are build-in to the standard UI (i.e., not installed
dynamically), but can still utilize the modular nature of UI
plugins. It works exactly the same way as a plugin, except:
-Modules are added to modules/ folder
-Modules are registered in modules/modules.js
-No config.js (no need for metadata, since they are built-in features)
- /ui/modules/ folder will not be touched by the build system, so any modules
are committed directly to the ui/ folder. In other words, modules are
not installed automatically.
- Add top label to zone switcher, add more styling
- Implement zone switching functionality, which on change sets
cloudStack.context.zoneType to the relevant filter option, or null
for 'All' zone types
- Supports DHCP, Source NAT, Static NAT, Firewall rules, Port Forwarding
- Renamed MidokuraMidonet to MidoNet
- Related Jira ticket is CLOUDSTACK-996
Signed-off-by: Dave Cahill <dcahill@midokura.com>
Signed-off-by: Hugo Trippaers <htrippaers@schubergphilis.com>
Update BigSwitch Plugin:
. UI support for adding BigSwitch controller as a network service provider
. Correct the message format between the plugin and the controller
. Add Health check API
Test to add a BigSwitch controller as a network service provider and view.
Test to implementation of guest network on the controller
Test to associate VM to its guest network
Adds a console helper function, which will reinitialize the UI
with the current window.cloudStack object. This is used primarily
for debugging, so that any changes to the UI structure can be viewed
without reloading the browser.
-Don't show dialog if no password enabled on start -- inhibits
'Start instance' dialog from appearing for every VM.
-Use standard dialog (not alert) for VM password notification
Puts secondary IP list view and detail view in dedicated section,
instead of as part of the public IP address section.
Removes conditional API calls from public IP address list/detail view
for secondary NICS.
-Move region UI code to ui-custom/regions.js, to separate from core UI
rendering
-Pull real data and endpoint URL on region select list, from data
provider in scripts/regions.js
-Make region selector have same appearance as notifications box
Update the following actions on IP address section to support per-NIC IP
addresses:
- List IPs -> listNics
- Add IP -> addIpToNic
- Remove IP -> removeIpFromNic
These API calls will be conditionally invoked in place of the existing
calls if a NIC is selected -- i.e., args.context.nics is present
-Call viewAll() on click to open new panel with corresponding view
-Pass context of selected item (such as nic object) to panel
-Allow custom title for panel
There was previously a limitation in the detail view/quickview where
only 1 'view all' link was visible per page. Change this to show n
number of view all links, if an array is passed to 'viewAll.' This also
lowers the # of clicks necessary to navigate to some items.
This also adds more view all buttons to instances, storage, and system
resources.
Adds a helper method to standardize how plugin writers handle server calls,
without having to directly invoke jQuery.ajax. It will correctly sanitize data
and ensure all required parameters (e.g., session key data) are passed.
Detail: Adds UI element for resizing a volume
BUG-ID: CLOUDSTACK-644
Reported-by: hongtu_zang@tcloudcomputing.com
Signed-off-by: Marcus Sorensen <marcus@betterservers.com> 1360091087 -0700
Add more metadata to plugin config.js:
- externalLink: Link to plugin/author's web site
- authorName: Author's full name
- authorEmail: Author's contact e-mail
Removing 'ellipses' effect for long list view values. They are
rendering in too many cases, making the data hard to read. Reverting
back to using standard word wrap for long table cells.
add xenserver support in UI
only XenServer and KVM clusters are allowed in security enabled zone.
only shared security enabled networks are allowed in security enabled zone.
When using SG-enabled advanced zone, fix case where 'add guest
network' form shows up in select network step -- adding a guest
network via the wizard is not supported in this type of setup.
-Fix missing icons on some dialog headers
-multiEdit: Fix overflow for long text strings
-Projects UI: Fix project selector margins, overflow on 'Events' box
on project dashboard
In addition to the main sectionPreFilter in the cloudStack UI, allow a
per-section 'preFilter' which is called if the navigation section is
not returned in sectionPreFilter. This is used primarily to support
plugin sections which will not be displayed by default.
Define plugins as namespaced objects instead of as function calls. This
is easier to implement and manage by the framework.
New format changes for defining plugins:
Now create 2 JS files in plugin folder:
-config.js
-[pluginName].js
plugins.js (listing) format:
cloudStack.plugins = [
'testPlugin'
];
config.js format:
cloudStack.plugins.testPlugin.config = {
title: 'Test Plugin',
desc: 'Sample plugin'
};
[pluginName].js format:
cloudStack.plugins.testPlugin = function(plugin) {
//
// Plugin code goes here
//
};
For zone wizard physical network step: Adds a text label to the top of
the 'edit' button indicating what type of traffic type (Management,
Storage, Guest, etc.)
When adding an item, show all returned fields if noSelect is
true. This prevents hidden conditional form fields from having their
row data hidden, such as if an ICMP rule is added and the TCP
start/end port form fields are hidden due to space constraints.
Rohit Yadav
Philipp Bankonier
Rohit Yadav
Dingane Hlaluku
Gabriel Beims Bräscher
dahn
Frank Maximus
Dingane Hlaluku
Gerd Müller
Henko
Philipp Bankonier
Rafael Weingärtner
Nicolas Vazquez
Paul Angus
ernjvr
Daan Hoogland
Mike Tutkowski
Mike Tutkowski
Frank Maximus
Khosrow Moossavi
Daan Hoogland
Olivier Lemasle
Rene Moser
Nitesh Sarda
Abhinandan Prateek
Mowgli
Wido den Hollander
Sigert Goeminne
Nitin Kumar Maharana
kishankavala
Syed Mushtaq Ahmed
Rohit Yadav
Sigert Goeminne
Harika Punna
vedulasantosh
Rashmi D
Sanket Thite
Suresh Kumar Anaparti
Wei Zhou
Wei Zhou
Nitin Kumar Maharana
Rajani Karuturi
Jayapal
subhash yedugundla
Rajani Karuturi
Daan Hoogland
Nathan Johnson
Anshul And Priyank
Milamber
Nitin Kumar Maharana
nvazquez
Will Stevens
Jayant Patil
pdumbre
Nick Livens
Pierre-Luc Dion
Koushik Das
Patrick Dube
Remi Bergsma
Rafael Weingärtner
Michael Andersen
Anshul Gangwar
Rajani Karuturi
Boris Schrijver
ramamurtis
Funs Kessen
Laszlo Hornyak
atrbgithub
Rajani Karuturi
Rene Moser
Kevin Dierkx
Erik Weber
Rafael da Fonseca
Vadim Kimlaychuk
Erik Weber
Remi Bergsma
KC Wang
vetrivelc
wilderrodrigues
Antonio Fornie
Jessica Wang
Brian Federle
Funs
Anthony Xu
Gabor Apati-Nagy
Sanjay Tripathi
René Moser
Jean-Francois Vincent
Mihaela Stoica
Daniel Vega
Devdeep Singh
Jessica Wang
Ilia Shakitko
Kishan Kavala
seif
seif
Brian Federle
Kishan Kavala
Ritu Sabharwal
Suresh Ramamurthy
Tim Mackey
Dariusz Nejbauer
Nitin Mehta
Chris Suich
Marcus Sorensen
Niels de Vos
Saksham Srivastava
Sachchidanand Vaidya
Hugo Trippaers
Wei Zhou
tuna
Chris Suich
Yichi Lu
Chip Childers
Will Stevens
chriscameronv
brito wang
ynojima
Wido den Hollander
Ian Duffy
Thomas O'Dowd
Mice Xia
Isaac Chiang
Pranav Saxena
Hiroaki KAWAI
Sheng Yang
Edison Su
Edison Su
Pranav Saxena
Min Chen
Murali Reddy
anthony
Alex Huang
Alena Prokharchyk
Sebastien Goasguen
Dave Cahill
Phong Nguyen
Kanzhe Jiang
Kishan Kavala
John Kinsella
