-
Notifications
You must be signed in to change notification settings - Fork 71
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
VM pools are displayed for non permitted users during manual/auto refresh #1343
Comments
Note that if Pool's "Maximum number of VMs per user" value is set to 4, then 2 pool VMs are displayed for non admin users on web-ui dashboard etc.. |
that means you have operational permissions to every single VM in the system. |
This issue is reproduced when UserRole is assigned on cluster level as well. |
yes, because then you granted operational permission to every single VM in that Cluster. Again, it's not what you typically want. |
Folks, if you still think this is an issue, then it should be fixed in the API. The API returns the VMs which shouldn't and the UI displays them. The query we use in the UI to fetch the VMs or just one single VM is correct. If this is not the issue, we should to make some changes in the webadmin regarding assigning permissions, to make sure (or at least better to inform) the admin assigns permissions the correct way to the correct entities. |
@hstastna partially correct since hard refresh does return a different result (without those vms) so we are not consistent. |
I ran some test on a 4.4.3 rpm install engine with master branch ovirt-web-ui and direct calls with curl. Pools created in 2 different clusters. A non-admin user has "UserRole" on a Pool in the first cluster and has "UserRole" on the second cluster in general. So when the user has "UserRole" only on the Pool, things work properly. Pools VMs that are not assigned/taken by a user return a 404 when queried directly. Stopping a taken VM automatically disappears from the card list and responds 404 with direct query. When the user has "UserRole" on the Cluster containing the Pool, things kinda work, but not really. The main VM/Pool fetching grabs the Pool but excludes all of the Pool VMs, even when the query is run directly. However, ALL Pool VMs in the pool can be directly queried, since they inherit UserRole from the cluster. That is what causes the VM Portal to hold on to a Stopped/returned/newly unassigned VMs. On background refresh in ovirt-web-ui, if a VM is known in the redux store, and is not updated with VM Only the VMs fetch that hits the ovirt-web-ui case on the REST API side works in the "UserRole" on cluster scenario. Since PR #1335 is not in 4.4.3, all the Pool VMs eventually show up after a round of background refreshing! What can we do to handle the "UserRole" on the Cluster issue?
|
I'm joining Scott on the issues he raised. I'm in the middle of automating VM Pools basic sanity tests and cannot proceed, because on the latest 4.4.4 user cannot allocate a VM from VM Pool if the pool has only 1 VM (it's free, no other user has it). Steps:
Results: Reproduced 100% on d/s: ovirt-engine-4.4.4.5-0.10.el8ev |
@isaranova the specific scenario you described here (pool with one VM pool) is not reproduced to me. can you please attach screenshots/videos? Thanks |
Seems like it was a broken hosted-engine environment - I retested on 3 different new rebuilt environments and cannot reproduce the issue anymore. Sorry for false report. |
This was reproduced to me on oVirt version 4.3.11 as well (web-ui version 1.6.0-1) and therefore it's not a new regression. |
Since this issue happens on a very specific timing when a new pool is still created and refresh is done on web-ui and since it is not a new regression then I suggest to avoid fixing it for now. |
After creating a new pool with "Maximum number of VMs per user" set to more than 3 vms, every logged non admin user in web-ui will view this new pool's VMs as part of his VMs list dashboard, even though they are not assigned to him.
Only after hard refresh (ctrl+F5) those new pool VMs are dismissed from user's VMs list dashboard
For reproducing:
Actual result:
![image](https://user-images.githubusercontent.com/18169498/101521302-55a5ca80-398e-11eb-8fcb-0788c9ce0066.png)
The new pool and one one pool VM will be displayed on VMs list dashboard. For example in case new pool name is eee-pool5, the following will be displayed on dashboard till hard refresh:
Expected result:
Only new pool card should be displayed without displaying any of the new pool VMs, since those pool VMs are not assigned to this logged user.
The text was updated successfully, but these errors were encountered: