Uh oh!
There was an error while loading. Please reload this page.
Added configuration and Integration test to restrict public template … - #4774
Conversation
Uh oh!
There was an error while loading. Please reload this page.
harikrishna-patnala
commented
Mar 9, 2021
@blueorangutan package |
blueorangutan
commented
Mar 9, 2021
@harikrishna-patnala a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
blueorangutan
commented
Mar 9, 2021
Packaging result: ✔centos7 ✔centos8 ✔debian. JID-2890 |
@soreana, does this have any impact on upgrades, existing templates in the environment might have already shared and used across domains. Does a domain lose viewing or accessing the templates which are already used when the configuration parameter is set to true. |
blueorangutan
commented
Mar 9, 2021
Packaging result: ✖️ centos7 ✖️ centos8 ✔️ debian. SL-JID 59 |
blueorangutan
commented
Mar 9, 2021
Packaging result: ✔️ centos7 ✖️ centos8 ✔️ debian. SL-JID 63 |
soreana
commented
Mar 9, 2021
@harikrishna-patnala I didn't noticed any issue. Here is what I tested today.
Let me know if you have other concerns. Btw, while I tried to reinstall the Without restriction (global setting sets to false)With restriction (global setting sets to true) |
harikrishna-patnala
commented
Mar 10, 2021
@soreana I have raised the question exactly like Reinstall VM you mentioned above, loosing access to the template which are already in use. May be keeping the configuration scope to Domain level will give flexibility in allowing access in these cases. Let's hear from others too. Thanks. |
DaanHoogland
commented
Mar 11, 2021
Not that I want to intrude on your discussion @soreana@harikrishna-patnala , but would it make sense to add a scope to the filter: all, featured, self, selfexecutable, sharedexecutable, executable, community, domain |
soreana
commented
Mar 11, 2021
@DaanHoogland It is nice feature. But it will not address access right issue fixed in this pr. |
@harikrishna-patnala In regards to your As a result, with or without these changes, the test2 user might lose access to the template. It is an inherent risk in using community templates. :D Reinstall VM before making Debian template privateReinstall VM after making Debian template private |
harikrishna-patnala
commented
Mar 15, 2021
Thanks @soreana for testing further. If you can add scope to domain that will be great. |
@harikrishna-patnala I updated the PR. I migrated the setting to the domain level. It is a limited code change required to do so :D. I tested that with subdomains as well. More details: If you set If you set Let me know if you have other concerns. P.S: I'm updating the test cases. |
nvazquez
commented
Jun 23, 2021
Hi @soreana looks like the PR has a conflict, can you please resolve it? |
harikrishna-patnala
commented
Jun 24, 2021
domain scope change looks good @soreana, please resolve the conflicts on the PR. |
soreana
commented
Jul 9, 2021
I fixed the conflict. |
nvazquez
commented
Jul 13, 2021
No problem, thanks @soreana |
blueorangutan
commented
Jul 13, 2021
@nvazquez a Jenkins job has been kicked to build packages. I'll keep you posted as I make progress. |
blueorangutan
commented
Jul 13, 2021
Packaging result: ✔️ el7 ✔️ el8 ✔️ debian. SL-JID 528 |
nvazquez
commented
Jul 13, 2021
@blueorangutan test |
blueorangutan
commented
Jul 13, 2021
@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests |
DaanHoogland
left a comment
There was a problem hiding this comment.
code looks generally good, needs testing and some remarks on the integration test
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
Uh oh!
There was an error while loading. Please reload this page.
blueorangutan
commented
Jul 13, 2021
Trillian test result (tid-1246)
|
nvazquez
commented
Aug 25, 2021
@soreana can you address the open comments on the marvin tests? |
4db539b to
b9ec1deCompareyadvr
commented
Apr 20, 2022
@blueorangutan package |
blueorangutan
commented
Apr 20, 2022
@rohityadavcloud a Jenkins job has been kicked to build packages. It will be bundled with SystemVM template(s). I'll keep you posted as I make progress. |
blueorangutan
commented
Apr 20, 2022
Packaging result: ✔️ el7 ✖️ el8 ✖️ debian ✖️ suse15. SL-JID 3251 |
nvazquez
commented
Apr 21, 2022
@blueorangutan package |
blueorangutan
commented
Apr 21, 2022
@nvazquez a Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress. |
blueorangutan
commented
Apr 21, 2022
Packaging result: ✔️ el7 ✔️ el8 ✔️ debian ✔️ suse15. SL-JID 3255 |
nvazquez
commented
Apr 21, 2022
@blueorangutan test |
blueorangutan
commented
Apr 21, 2022
@nvazquez a Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests |
sureshanaparti
commented
Apr 21, 2022
Manually covered with the following tests, and verified the public templates access restricted to other domains when the global or the respective domain's config "share.public.templates.with.other.domains" is set to false.
Tests with global level setting: Tests with domain level setting: |
nvazquez
commented
Apr 21, 2022
Hi @soreana all looking good except travis that is still failing in all these cases: |
| Function to update the global setting "restrict.public.access.to.templates" for domain | ||
| """ | ||
| update_configuration_cmd = updateConfiguration.updateConfigurationCmd() | ||
| update_configuration_cmd.name = "restrict.public.template.access.to.domain" |
There was a problem hiding this comment.
@soreana
since you have changed the name of global configuration to share.public.templates.with.other.domains, can you change the name in component test ? (maybe the value as well)
Uh oh!
There was an error while loading. Please reload this page.
The test needs to be updated to use the new configuration name
acs-robot
commented
Apr 21, 2022
Found UI changes, kicking a new UI QA build |
blueorangutan
commented
Apr 21, 2022
Trillian test result (tid-3958)
|
acs-robot
commented
Apr 21, 2022
PR Coverage Report
|
…PR: apache#4774 in commit e94c1e2. Had to make a few changes to support 4.11 and cleanup some of the quirks.
* Pulling in the relevant parts of the global settings version of this PR: apache#4774 in commit e94c1e2. Had to make a few changes to support 4.11 and cleanup some of the quirks. * Making the 'allow.public.user.templates' global setting allow domain and resource admins to still upload public templates. Previously it was limited to just root admins. * One additional template filter type that includes public templates * Fixing permissions bug where there weren't permissions to templates in child domains * Updating comments based on code review * Was previously allowing public, but not featured for domain admins. Added featured for domain admins. Also limited public to only when the new setting is enabled.




Description
As a cloud provider, we don't want our customers to see other templates. This pr limits template access to the domain.
Types of changes
Feature/Enhancement Scale or Bug Severity
Feature/Enhancement Scale
How Has This Been Tested?
To test this feature, I created two domains named Test0, Test1 and Test2, each with their respective domain admins (test0, test1 and test2).
I used cloudmonkey command to list different combination of templateFilters ( all, featured, self, selfexecutable, sharedexecutable, executable and community ) and accounts ( admin, test0, test1 and test2 ).
Pre configuration:
Test case one.
share.public.templatesto false for every domainTest case two
share.public.templateslike the following table.test0account. You should see combination of theU20, U0, U2with differenttemplatefilterbut notU1Test case three
share.public.templateslike the test case twotest0with template id. You should be ablet to see theU20, U0, U2but empty result if you useU1id.I wrote this script to test this pr, you can find it in the following link. You need the
cmkcommand and you should putadmin,test1, andtest2users info in the cmk configuration file. How to run this?