You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by pe...@apache.org on 2025/05/27 14:41:20 UTC
(cloudstack) branch 4.20 updated (d5fbd07b9fb -> 6bb6fe7b41f)
This is an automated email from the ASF dual-hosted git repository.
pearl11594 pushed a change to branch 4.20
in repository https://gitbox.apache.org/repos/asf/cloudstack.git
from d5fbd07b9fb Adding privilege checks on user and account operations
add 38f3107211b Fix aaccess to template/ISO list for domain/resource admins
add ad9d9cd3f68 Keep same/consistent auth time for valid & invalid users
add e2f187912cd cks: create separate service account in project
add a0080a04fe6 Adding privilege checks on user and account operations
new 6bb6fe7b41f Merge branch '4.19' into 4.20
The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
Summary of changes:
.../cluster/KubernetesClusterManagerImpl.java | 27 ++++++++++++++++++++++
.../configuration/ConfigurationManagerImpl.java | 27 ++++++++++++++++++++++
2 files changed, 54 insertions(+)
(cloudstack) 01/01: Merge branch '4.19' into 4.20
Posted by pe...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
pearl11594 pushed a commit to branch 4.20
in repository https://gitbox.apache.org/repos/asf/cloudstack.git
commit 6bb6fe7b41f44f6cf201b28b9ce33528737ba86f
Merge: d5fbd07b9fb a0080a04fe6
Author: Pearl Dsilva <pe...@gmail.com>
AuthorDate: Tue May 27 20:10:58 2025 +0530
Merge branch '4.19' into 4.20
.../cluster/KubernetesClusterManagerImpl.java | 27 ++++++++++++++++++++++
.../configuration/ConfigurationManagerImpl.java | 27 ++++++++++++++++++++++
2 files changed, 54 insertions(+)
diff --cc plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
index 5e86bb6daf0,3fea585cbfe..ee517c1ccf9
--- a/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
+++ b/plugins/integrations/kubernetes-service/src/main/java/com/cloud/kubernetes/cluster/KubernetesClusterManagerImpl.java
@@@ -215,41 -214,36 +215,68 @@@ import org.apache.logging.log4j.Level
public class KubernetesClusterManagerImpl extends ManagerBase implements KubernetesClusterService {
- private static final Logger LOGGER = Logger.getLogger(KubernetesClusterManagerImpl.class);
private static final String DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME = "DefaultNetworkOfferingforKubernetesService";
+ private static final List<Class<?>> PROJECT_KUBERNETES_ACCOUNT_ROLE_ALLOWED_APIS = Arrays.asList(
+ QueryAsyncJobResultCmd.class,
+ ListVMsCmd.class,
+ ListNetworksCmd.class,
+ ListPublicIpAddressesCmd.class,
+ AssociateIPAddrCmd.class,
+ DisassociateIPAddrCmd.class,
+ ListLoadBalancerRulesCmd.class,
+ CreateLoadBalancerRuleCmd.class,
+ UpdateLoadBalancerRuleCmd.class,
+ DeleteLoadBalancerRuleCmd.class,
+ AssignToLoadBalancerRuleCmd.class,
+ RemoveFromLoadBalancerRuleCmd.class,
+ ListLoadBalancerRuleInstancesCmd.class,
+ ListFirewallRulesCmd.class,
+ CreateFirewallRuleCmd.class,
+ UpdateFirewallRuleCmd.class,
+ DeleteFirewallRuleCmd.class,
+ ListNetworkACLsCmd.class,
+ CreateNetworkACLCmd.class,
+ DeleteNetworkACLCmd.class,
+ ListKubernetesClustersCmd.class,
+ ScaleKubernetesClusterCmd.class
+ );
+ private static final String PROJECT_KUBERNETES_ACCOUNT_FIRST_NAME = "Kubernetes";
+ private static final String PROJECT_KUBERNETES_ACCOUNT_LAST_NAME = "Service User";
+
+ private static final String DEFAULT_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT = "Network Offering used for CloudStack Kubernetes service";
+ private static final String DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME = "DefaultNSXNetworkOfferingforKubernetesService";
+ private static final String DEFAULT_NSX_VPC_TIER_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_NAME = "DefaultNSXVPCNetworkOfferingforKubernetesService";
+ private static final String DEFAULT_NSX_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT = "Network Offering for NSX CloudStack Kubernetes Service";
+ private static final String DEFAULT_NSX_VPC_NETWORK_OFFERING_FOR_KUBERNETES_SERVICE_DISPLAY_TEXT = "Network Offering for NSX CloudStack Kubernetes service on VPC";
+
+ private static final List<Class<?>> PROJECT_KUBERNETES_ACCOUNT_ROLE_ALLOWED_APIS = Arrays.asList(
+ QueryAsyncJobResultCmd.class,
+ ListVMsCmd.class,
+ ListNetworksCmd.class,
+ ListPublicIpAddressesCmd.class,
+ AssociateIPAddrCmd.class,
+ DisassociateIPAddrCmd.class,
+ ListLoadBalancerRulesCmd.class,
+ CreateLoadBalancerRuleCmd.class,
+ UpdateLoadBalancerRuleCmd.class,
+ DeleteLoadBalancerRuleCmd.class,
+ AssignToLoadBalancerRuleCmd.class,
+ RemoveFromLoadBalancerRuleCmd.class,
+ ListLoadBalancerRuleInstancesCmd.class,
+ ListFirewallRulesCmd.class,
+ CreateFirewallRuleCmd.class,
+ UpdateFirewallRuleCmd.class,
+ DeleteFirewallRuleCmd.class,
+ ListNetworkACLsCmd.class,
+ CreateNetworkACLCmd.class,
+ DeleteNetworkACLCmd.class,
+ ListKubernetesClustersCmd.class,
+ ScaleKubernetesClusterCmd.class
+ );
+ private static final String PROJECT_KUBERNETES_ACCOUNT_FIRST_NAME = "Kubernetes";
+ private static final String PROJECT_KUBERNETES_ACCOUNT_LAST_NAME = "Service User";
+
protected StateMachine2<KubernetesCluster.State, KubernetesCluster.Event, KubernetesCluster> _stateMachine = KubernetesCluster.State.getStateMachine();
ScheduledExecutorService _gcExecutor;
diff --cc server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
index c8ab6b4b069,4c03122e463..51e79ae72c4
--- a/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
+++ b/server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java
@@@ -1504,14 -1345,45 +1504,41 @@@ public class ConfigurationManagerImpl e
}
if (configuration.getRange() == null) {
- return null;
+ logger.debug("Not proceeding with configuration [{}]'s range validation, as it does not have a specified range.", name);
+ return false;
}
- String[] range = configuration.getRange().split(",");
- if (type.equals(String.class)) {
- return validateIfStringValueIsInRange(name, value, range);
- } else if (type.equals(Integer.class)) {
- return validateIfIntValueIsInRange(name, value, range[0]);
- }
- return String.format("Invalid value for configuration [%s].", name);
+ logger.debug("Proceeding with configuration [{}]'s range validation.", name);
+ return true;
}
+ protected void validateConfigurationAllowedOnlyForDefaultAdmin(String configName, String value) {
+ if (configKeysAllowedOnlyForDefaultAdmin.contains(configName)) {
+ final Long userId = CallContext.current().getCallingUserId();
+ if (userId != User.UID_ADMIN) {
+ throw new CloudRuntimeException("Only default admin is allowed to change this setting");
+ }
+
+ if (AccountManagerImpl.listOfRoleTypesAllowedForOperationsOfSameRoleType.key().equals(configName)) {
+ if (value != null && !value.isBlank()) {
+ List<String> validRoleTypes = Arrays.stream(RoleType.values())
+ .map(Enum::name)
+ .collect(Collectors.toList());
+
+ boolean allValid = Arrays.stream(value.split(","))
+ .map(String::trim)
+ .allMatch(validRoleTypes::contains);
+
+ if (!allValid) {
+ throw new CloudRuntimeException("Invalid role types provided in value");
+ }
+ } else {
+ throw new CloudRuntimeException("Value for role types must not be empty");
+ }
+ }
+ }
+ }
+
/**
* A valid value should be an integer between min and max (the values from the range).
*/