aeolus-devel January 2011

aeolus-devel@lists.fedorahosted.org

14 participants
42 discussions

Start a nNew thread

initial aeolus-configure ssl integration (rev 2)
by Mo Morsi 10 Feb '11

10 Feb '11

This patchset integrates ssl support for https and postgres into the aeolus puppet recipe and configuration scripts

2 9

[PATCH configure] seed aeolus db and start solr search services
by Mo Morsi 03 Feb '11

03 Feb '11

--- recipes/deltacloud_recipe/manifests/aggregator.pp | 28 ++++++++++++++++++- .../deltacloud_recipe/manifests/image-factory.pp | 2 +- recipes/deltacloud_recipe/manifests/rails.pp | 7 +++++ 3 files changed, 34 insertions(+), 3 deletions(-) diff --git a/recipes/deltacloud_recipe/manifests/aggregator.pp b/recipes/deltacloud_recipe/manifests/aggregator.pp index 1a4c6cb..716d28c 100644 --- a/recipes/deltacloud_recipe/manifests/aggregator.pp +++ b/recipes/deltacloud_recipe/manifests/aggregator.pp @@ -35,7 +35,7 @@ class deltacloud::aggregator inherits deltacloud { enable => true, hasstatus => true, require => [Package['deltacloud-aggregator-daemons'], - Rails::Migrate::Db[migrate_deltacloud_database], + Rails::Seed::Db[seed_deltacloud_database], Service[condor]] } ### Initialize and start the deltacloud database @@ -60,6 +60,23 @@ class deltacloud::aggregator inherits deltacloud { cwd => "/usr/share/deltacloud-aggregator", rails_env => "production", require => Rails::Create::Db[create_deltacloud_database]} + rails::seed::db{"seed_deltacloud_database": + cwd => "/usr/share/deltacloud-aggregator", + rails_env => "production", + require => Rails::Migrate::Db[migrate_deltacloud_database]} + + + ### Setup/start solr search service + exec{"start_solr": + cwd => "/usr/share/deltacloud-aggregator", + command => "/usr/bin/rake sunspot:solr:start", + environment => "RAILS_ENV=production", + require => Package['deltacloud-aggregator']} + exec{"build_solr_index": + cwd => "/usr/share/deltacloud-aggregator", + command => "/usr/bin/rake sunspot:reindex", + environment => "RAILS_ENV=production", + require => Exec['start_solr']} } class deltacloud::aggregator::disabled { @@ -108,6 +125,13 @@ class deltacloud::aggregator::disabled { postgres::user{"dcloud": ensure => 'dropped', require => Rails::Drop::Db["drop_deltacloud_database"]} + + ### stop solr search service + exec{"stop_solr": + cwd => "/usr/share/deltacloud-aggregator", + command => "/usr/bin/rake sunspot:solr:stop", + environment => "RAILS_ENV=production", + require => Service['deltacloud-aggregator']} } # Create a new site admin aggregator web user @@ -117,7 +141,7 @@ define deltacloud::site_admin($email="", $password="", $first_name="", $last_nam environment => "RAILS_ENV=production", command => "/usr/bin/rake dc:create_user[${name}] email=${email} password=${password} first_name=${first_name} last_name=${last_name}", unless => "/usr/bin/test `psql dcloud dcloud -P tuples_only -c \"select count(*) from users where login = '${name}';\"` = \"1\"", - require => Rails::Migrate::Db["migrate_deltacloud_database"]} + require => Rails::Seed::Db["seed_deltacloud_database"]} exec{"grant_site_admin_privs": cwd => '/usr/share/deltacloud-aggregator', environment => "RAILS_ENV=production", diff --git a/recipes/deltacloud_recipe/manifests/image-factory.pp b/recipes/deltacloud_recipe/manifests/image-factory.pp index 036c0e7..c584d5a 100644 --- a/recipes/deltacloud_recipe/manifests/image-factory.pp +++ b/recipes/deltacloud_recipe/manifests/image-factory.pp @@ -57,7 +57,7 @@ class deltacloud::image-factory inherits deltacloud { Package['deltacloud-aggregator-daemons'], File['/etc/imagefactory.yml'], Service[qpidd], - Rails::Migrate::Db[migrate_deltacloud_database], + Rails::Seed::Db[seed_deltacloud_database], Notify['boxgrinder_configured']] service { 'imagefactoryd': ensure => 'running', diff --git a/recipes/deltacloud_recipe/manifests/rails.pp b/recipes/deltacloud_recipe/manifests/rails.pp index 438a209..701abe3 100644 --- a/recipes/deltacloud_recipe/manifests/rails.pp +++ b/recipes/deltacloud_recipe/manifests/rails.pp @@ -15,6 +15,13 @@ define rails::migrate::db($cwd="", $rails_env=""){ command => "/usr/bin/rake db:migrate"} } +define rails::seed::db($cwd="", $rails_env=""){ + exec{"seed_rails_database": + cwd => $cwd, + environment => "RAILS_ENV=${rails_env}", + command => "/usr/bin/rake db:seed"} +} + define rails::drop::db($cwd="", $rails_env=""){ exec{"drop_rails_database": cwd => $cwd, -- 1.7.2.3

2 6

Task #197 - Remove any logic forcing one provider only
by jzigmund＠redhat.com 02 Feb '11

02 Feb '11

This patchset contains not only code for task #197, but also it contains renaming model of CloudAccount to ProviderAccount, and all fixings, that they were needed for green tests and changes in next branch, while this patchset was written. You need to apply all patches to work it well, when you will make a review.

2 13

[PATCH 0/4]: Rename the deltacloud aggregator to aeolus conductor
by Chris Lalancette 02 Feb '11

02 Feb '11

This patch series goes the last mile on the rename of the deltacloud aggregator to the aeolus conductor. In particular, all of configure and all of conductor is renamed, including packages. The first 3 patches fix up the configure repository to use "aeolus" and "conductor" instead of "deltacloud" and "aggregator". They are mostly mmorsi's work that he posted last week, plus some additional tweaks that I had to make. Patch 4 renames all of the conductor repository to aeolus-conductor where appropriate. I did all of this work, so any errors are mine :). Unfortunately I was not able to test these patches because I could not get solr up and running. I am going to be away for a few days, so I thought I would send this series out and hope that someone who can get solr up can test it out, fix any remaining bugs, and push it.

2 5

[PATCH aeolus] Add search on Instance owner name attributes
by steve linabery 02 Feb '11

02 Feb '11

This slipped through the cracks on a previous ACK from yours truly. --- src/app/models/instance.rb | 3 +++ src/features/instance.feature | 20 +++++++++++++++++--- src/features/step_definitions/instance_steps.rb | 10 ++++++++++ src/spec/factories/instance.rb | 5 +++++ src/spec/factories/user.rb | 5 +++++ 5 files changed, 40 insertions(+), 3 deletions(-) diff --git a/src/app/models/instance.rb b/src/app/models/instance.rb index b84a596..b6af901 100644 --- a/src/app/models/instance.rb +++ b/src/app/models/instance.rb @@ -30,6 +30,9 @@ class Instance < ActiveRecord::Base text :public_addresses, :as => :code_substring text :private_addresses, :as => :code_substring text :state, :as => :code_substring + text :owner do + owner.last_name + " " + owner.first_name + end end cattr_reader :per_page diff --git a/src/features/instance.feature b/src/features/instance.feature index ad22025..5794333 100644 --- a/src/features/instance.feature +++ b/src/features/instance.feature @@ -81,32 +81,46 @@ Feature: Mange Instances Scenario: Search for instances Given there are the following instances: | name | external_key | state | public_addresses | private_addresses | - | mock | ext_mock | running | mock.public.address | mock.private.address | + | mockname | ext_mock | running | mock.public.address | mock.private.address | | test | ext_test | pending | test.public.address | test.private.address | | other | ext_other | stopped | other.public.address | other.private.address | + And there is the following instance with a differently-named owning user: + | name | external_key | state | public_addresses | private_addresses | + | foo | ext_foo | stopped | foo.public.address | foo.private.address | And I am on the the instances page - When I fill in "q" with "mock" + When I fill in "q" with "mockname" And I press "Search" Then I should see "mock" And I should not see "test" And I should not see "other" + And I should not see "foo" When I fill in "q" with "ext_other" And I press "Search" Then I should not see "mock" And I should not see "test" And I should see "other" + And I should not see "foo" When I fill in "q" with "pending" And I press "Search" Then I should not see "mock" And I should see "test" And I should not see "other" + And I should not see "foo" When I fill in "q" with "mock.public.address" And I press "Search" Then I should see "mock" And I should not see "test" And I should not see "other" + And I should not see "foo" When I fill in "q" with "test.private.address" And I press "Search" Then I should not see "mock" And I should see "test" - And I should not see "other" \ No newline at end of file + And I should not see "other" + And I should not see "foo" + When I fill in "q" with "Doe" + And I press "Search" + Then I should not see "mock" + And I should not see "test" + And I should not see "other" + And I should see "foo" diff --git a/src/features/step_definitions/instance_steps.rb b/src/features/step_definitions/instance_steps.rb index 4324891..4cca209 100644 --- a/src/features/step_definitions/instance_steps.rb +++ b/src/features/step_definitions/instance_steps.rb @@ -78,3 +78,13 @@ Given /^there are the following instances:$/ do |table| :private_addresses => hash['private_addresses']) end end + +Given /^there is the following instance with a differently-named owning user:$/ do |table| + table.hashes.each do |hash| + Factory(:other_owner_instance, :name => hash['name'], + :external_key => hash['external_key'], + :state => hash['state'], + :public_addresses => hash['public_addresses'], + :private_addresses => hash['private_addresses']) + end +end diff --git a/src/spec/factories/instance.rb b/src/spec/factories/instance.rb index 7533ba9..dd49f9f 100644 --- a/src/spec/factories/instance.rb +++ b/src/spec/factories/instance.rb @@ -9,6 +9,11 @@ Factory.define :instance do |i| i.state "running" end +Factory.define :other_owner_instance, :parent => :instance do |i| + i.association :owner, :factory => :other_named_user +end + + Factory.define :mock_running_instance, :parent => :instance do |i| i.instance_key { |k| k.association(:mock_instance_key)} end diff --git a/src/spec/factories/user.rb b/src/spec/factories/user.rb index a9dd23e..22abc5e 100644 --- a/src/spec/factories/user.rb +++ b/src/spec/factories/user.rb @@ -8,6 +8,11 @@ Factory.define :user do |u| u.association :quota end +Factory.define :other_named_user, :parent => :user do |u| + u.first_name 'Jane' + u.last_name 'Doe' +end + Factory.define :tuser, :parent => :user do |u| end -- 1.7.3.4

2 1

[PATCH] automatically create permission records for users when they create objects.
by Scott Seago 01 Feb '11

01 Feb '11

Signed-off-by: Scott Seago <sseago(a)redhat.com> --- .../controllers/admin/pool_families_controller.rb | 1 + .../admin/provider_accounts_controller.rb | 1 + src/app/controllers/admin/providers_controller.rb | 1 + .../image_factory/templates_controller.rb | 1 + src/app/controllers/instances_controller.rb | 2 + .../controllers/resources/instances_controller.rb | 2 + src/app/controllers/resources/pools_controller.rb | 1 + src/app/models/permissioned_object.rb | 16 ++++- src/db/migrate/20110119000000_owner_roles.rb | 46 +++++++++++ src/db/seeds.rb | 85 ++++++++++---------- src/spec/controllers/instance_controller_spec.rb | 29 +++++++ src/spec/factories/permission.rb | 8 ++- src/spec/factories/user.rb | 5 + 13 files changed, 154 insertions(+), 44 deletions(-) create mode 100644 src/db/migrate/20110119000000_owner_roles.rb diff --git a/src/app/controllers/admin/pool_families_controller.rb b/src/app/controllers/admin/pool_families_controller.rb index 9fe2c25..42bfb04 100644 --- a/src/app/controllers/admin/pool_families_controller.rb +++ b/src/app/controllers/admin/pool_families_controller.rb @@ -15,6 +15,7 @@ class Admin::PoolFamiliesController < ApplicationController flash.now[:warning] = "Pool family's creation failed." render :new and return else + @pool_family.assign_owner_roles(current_user) flash[:notice] = "Pool family was added." redirect_to admin_pool_families_path end diff --git a/src/app/controllers/admin/provider_accounts_controller.rb b/src/app/controllers/admin/provider_accounts_controller.rb index d422a53..132d8a1 100644 --- a/src/app/controllers/admin/provider_accounts_controller.rb +++ b/src/app/controllers/admin/provider_accounts_controller.rb @@ -73,6 +73,7 @@ class Admin::ProviderAccountsController < ApplicationController @cloud_account.pool_families << PoolFamily.default @cloud_account.save! + @cloud_account.assign_owner_roles(current_user) if @cloud_account.populate_realms flash[:notice] = "Provider account added." end diff --git a/src/app/controllers/admin/providers_controller.rb b/src/app/controllers/admin/providers_controller.rb index a898d72..0490af8 100644 --- a/src/app/controllers/admin/providers_controller.rb +++ b/src/app/controllers/admin/providers_controller.rb @@ -54,6 +54,7 @@ class Admin::ProvidersController < ApplicationController else @provider.set_cloud_type! if @provider.save && @provider.populate_hardware_profiles + @provider.assign_owner_roles(current_user) flash[:notice] = "Provider added." redirect_to admin_providers_path else diff --git a/src/app/controllers/image_factory/templates_controller.rb b/src/app/controllers/image_factory/templates_controller.rb index 11f410b..58caecd 100644 --- a/src/app/controllers/image_factory/templates_controller.rb +++ b/src/app/controllers/image_factory/templates_controller.rb @@ -72,6 +72,7 @@ class ImageFactory::TemplatesController < ApplicationController @tpl = Template.new(params[:tpl]) @tpl.packages = params[:packages] if @tpl.save + @tpl.assign_owner_roles(current_user) flash[:notice] = "Template saved." @tpl.set_complete redirect_to image_factory_templates_path diff --git a/src/app/controllers/instances_controller.rb b/src/app/controllers/instances_controller.rb index e22aea4..e877729 100644 --- a/src/app/controllers/instances_controller.rb +++ b/src/app/controllers/instances_controller.rb @@ -101,6 +101,8 @@ class InstancesController < ApplicationController Pool.find((a)instance.pool_id)) #FIXME: This should probably be in a transaction if @instance.save! + # set owner permissions: + @instance.assign_owner_roles(current_user) @task = InstanceTask.new({:user => current_user, :task_target => @instance, :action => InstanceTask::ACTION_CREATE}) diff --git a/src/app/controllers/resources/instances_controller.rb b/src/app/controllers/resources/instances_controller.rb index 9482a8d..9d2b5c8 100644 --- a/src/app/controllers/resources/instances_controller.rb +++ b/src/app/controllers/resources/instances_controller.rb @@ -55,6 +55,8 @@ class Resources::InstancesController < ApplicationController free_quota = Quota.can_start_instance?(@instance, nil) @instance.transaction do @instance.save! + # set owner permissions: + @instance.assign_owner_roles(current_user) @task = InstanceTask.create!({:user => current_user, :task_target => @instance, :action => InstanceTask::ACTION_CREATE}) diff --git a/src/app/controllers/resources/pools_controller.rb b/src/app/controllers/resources/pools_controller.rb index c5988ca..b2bc8f9 100644 --- a/src/app/controllers/resources/pools_controller.rb +++ b/src/app/controllers/resources/pools_controller.rb @@ -48,6 +48,7 @@ class Resources::PoolsController < ApplicationController @pool.quota_id = quota.id @pool.pool_family = PoolFamily.default if @pool.save + @pool.assign_owner_roles(current_user) flash[:notice] = "Pool added." redirect_to :action => 'show', :id => @pool.id else diff --git a/src/app/models/permissioned_object.rb b/src/app/models/permissioned_object.rb index 34efec8..ee2685f 100644 --- a/src/app/models/permissioned_object.rb +++ b/src/app/models/permissioned_object.rb @@ -41,6 +41,20 @@ module PermissionedObject [self, BasePermissionObject.general_permission_scope] end + # assign owner role so that the creating user has permissions on the object + # Any roles defined on default_privilege_target_type with assign_to_owner==true + # will be assigned to the passed-in user on this object + def assign_owner_roles(user) + roles = Role.find(:all, :conditions => ["assign_to_owner =:assign and scope=:scope", + { :assign => true, + :scope => self.class.default_privilege_target_type.name}]) + roles.each do |role| + permission = Permission.create!(:role => role, + :user => user, + :permission_object => self) + end + end + # Any methods here will be able to use the context of the # ActiveRecord model the module is included in. def self.included(base) @@ -82,7 +96,7 @@ module PermissionedObject if query_conditions.nil? conditions_str = self.list_for_user_conditions else - conditions_str = "(#{self.list_for_user_include}) and (#{query_conditions[0]})" + conditions_str = "(#{self.list_for_user_conditions}) and (#{query_conditions[0]})" conditions_hash.merge!(query_conditions[1]) { |key, h1, h2| h1 } end find(:all, :include => include_clause, diff --git a/src/db/migrate/20110119000000_owner_roles.rb b/src/db/migrate/20110119000000_owner_roles.rb new file mode 100644 index 0000000..15ebd84 --- /dev/null +++ b/src/db/migrate/20110119000000_owner_roles.rb @@ -0,0 +1,46 @@ +# +# Copyright (C) 2011 Red Hat, Inc. +# Written by Scott Seago <sseago(a)redhat.com> +# +# This program is free software; you can redistribute it and/or modify +# it under the terms of the GNU General Public License as published by +# the Free Software Foundation; version 2 of the License. +# +# This program is distributed in the hope that it will be useful, +# but WITHOUT ANY WARRANTY; without even the implied warranty of +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +# GNU General Public License for more details. +# +# You should have received a copy of the GNU General Public License +# along with this program; if not, write to the Free Software +# Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, +# MA 02110-1301, USA. A copy of the GNU General Public License is +# also available at http://www.gnu.org/copyleft/gpl.html. + +class OwnerRoles < ActiveRecord::Migration + + OWNER_ROLES = ["Instance Owner", + "Pool Family Owner", + "Pool Owner", + "Provider Owner", + "Provider Account Owner", + "Template Owner"] + + def self.up + add_column :roles, :assign_to_owner, :boolean, :default => false + + Role.transaction do + OWNER_ROLES.each do |role_name| + role = Role.find_by_name(role_name) + unless role.nil? + role.assign_to_owner = true + role.save! + end + end + end + end + + def self.down + remove_column :roles, :assign_to_owner + end +end diff --git a/src/db/seeds.rb b/src/db/seeds.rb index 9a6065c..71726bf 100644 --- a/src/db/seeds.rb +++ b/src/db/seeds.rb @@ -15,57 +15,58 @@ GPRM = "set_perms" roles = {Instance => - {"Instance Controller" => {Instance => [VIEW,USE]}, - "Instance Owner" => {Instance => [VIEW,USE,MOD, VPRM,GPRM]}}, + {"Instance Controller" => [false, {Instance => [VIEW,USE]}], + "Instance Owner" => [true, {Instance => [VIEW,USE,MOD, VPRM,GPRM]}]}, PoolFamily => - {"Pool Family User" => {Pool => [VIEW]}, - "Pool Family Owner" => {PoolFamily => [VIEW, MOD, VPRM,GPRM], - Pool => [VIEW, MOD,CRE,VPRM,GPRM]}}, + {"Pool Family User" => [false, {Pool => [VIEW]}], + "Pool Family Owner" => [true, {PoolFamily => [VIEW, MOD, VPRM,GPRM], + Pool => [VIEW, MOD,CRE,VPRM,GPRM]}]}, Pool => - {"Pool User" => {Pool => [VIEW], - Instance => [ CRE], - Quota => [VIEW]}, - "Pool Owner" => {Pool => [VIEW, MOD, VPRM,GPRM], - Instance => [VIEW,USE,MOD,CRE], - Quota => [VIEW]}}, + {"Pool User" => [false, {Pool => [VIEW], + Instance => [ CRE], + Quota => [VIEW]}], + "Pool Owner" => [true, {Pool => [VIEW, MOD, VPRM,GPRM], + Instance => [VIEW,USE,MOD,CRE], + Quota => [VIEW]}]}, Provider => - {"Provider Owner" => {Provider => [VIEW, MOD, VPRM,GPRM], - CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}}, + {"Provider Owner" => [true, {Provider => [VIEW, MOD, VPRM,GPRM], + CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}]}, CloudAccount => - {"Provider Account User" => {CloudAccount => [VIEW,USE]}, - "Provider Account Owner" => {CloudAccount => [VIEW,USE,MOD, VPRM,GPRM]}}, + {"Provider Account User" => [false, {CloudAccount => [VIEW,USE]}], + "Provider Account Owner" => [true, {CloudAccount => [VIEW,USE,MOD, VPRM,GPRM]}]}, Template => - {"Template User" => {Template => [VIEW,USE]}, - "Template Owner" => {Template => [VIEW,USE,MOD, VPRM,GPRM]}}, + {"Template User" => [false, {Template => [VIEW,USE]}], + "Template Owner" => [true, {Template => [VIEW,USE,MOD, VPRM,GPRM]}]}, BasePermissionObject => - {"Provider Creator" => {Provider => [ CRE]}, - "Provider Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM], - CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}, - "HWP Administrator" => {HardwareProfile => [ MOD,CRE,VPRM,GPRM]}, - "Realm Administrator" => {Realm => [ USE,MOD,CRE,VPRM,GPRM]}, - "Pool Creator" => {Pool => [ CRE]}, - "Pool Administrator" => {Pool => [VIEW, MOD,CRE,VPRM,GPRM], - Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM], - Quota => [VIEW, MOD], - PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM]}, - "Template Administrator" => {Template => [VIEW,USE,MOD,CRE,VPRM,GPRM]}, - "Administrator" => {Provider => [VIEW, MOD,CRE,VPRM,GPRM], - CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM], - HardwareProfile => [ MOD,CRE,VPRM,GPRM], - Realm => [ USE,MOD,CRE,VPRM,GPRM], - User => [VIEW, MOD,CRE], - Pool => [VIEW, MOD,CRE,VPRM,GPRM], - Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM], - Quota => [VIEW, MOD], - PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM], - Template => [VIEW,USE,MOD,CRE,VPRM,GPRM], - BasePermissionObject => [ MOD, VPRM,GPRM]}}} + {"Provider Creator" => [false, {Provider => [ CRE]}], + "Provider Administrator" => [false, {Provider => [VIEW, MOD,CRE,VPRM,GPRM], + CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM]}], + "HWP Administrator" => [false, {HardwareProfile => [ MOD,CRE,VPRM,GPRM]}], + "Realm Administrator" => [false, {Realm => [ USE,MOD,CRE,VPRM,GPRM]}], + "Pool Creator" => [false, {Pool => [ CRE]}], + "Pool Administrator" => [false, {Pool => [VIEW, MOD,CRE,VPRM,GPRM], + Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM], + Quota => [VIEW, MOD], + PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM]}], + "Template Administrator" => [false, {Template => [VIEW,USE,MOD,CRE,VPRM,GPRM]}], + "Administrator" => [false, {Provider => [VIEW, MOD,CRE,VPRM,GPRM], + CloudAccount => [VIEW,USE,MOD,CRE,VPRM,GPRM], + HardwareProfile => [ MOD,CRE,VPRM,GPRM], + Realm => [ USE,MOD,CRE,VPRM,GPRM], + User => [VIEW, MOD,CRE], + Pool => [VIEW, MOD,CRE,VPRM,GPRM], + Instance => [VIEW,USE,MOD,CRE,VPRM,GPRM], + Quota => [VIEW, MOD], + PoolFamily => [VIEW, MOD,CRE,VPRM,GPRM], + Template => [VIEW,USE,MOD,CRE,VPRM,GPRM], + BasePermissionObject => [ MOD, VPRM,GPRM]}]}} Role.transaction do roles.each do |role_scope, scoped_hash| - scoped_hash.each do |role_name, role_privileges| - role_privileges.each do |priv_type, priv_actions| + scoped_hash.each do |role_name, role_def| + role_def[1].each do |priv_type, priv_actions| role = Role.find_or_initialize_by_name(role_name) - role.update_attributes({:name => role_name, :scope => role_scope.name}) + role.update_attributes({:name => role_name, :scope => role_scope.name, + :assign_to_owner => role_def[0]}) role.save! priv_actions.each do |action| Privilege.create!(:role => role, :target_type => priv_type.name, diff --git a/src/spec/controllers/instance_controller_spec.rb b/src/spec/controllers/instance_controller_spec.rb index 34a44c8..628f53a 100644 --- a/src/spec/controllers/instance_controller_spec.rb +++ b/src/spec/controllers/instance_controller_spec.rb @@ -38,4 +38,33 @@ describe InstancesController do inst = Instance.find(:first, :conditions => ['name = ?', 'mockinstance']) inst.owner_id.should == @pool_user.id end + + it "should NOT allow pool users to see each other's instances" do + @pool_user_permission = Factory :pool_user_permission + @pool_user = @pool_user_permission.user + @pool_user2_permission = Factory :pool_user2_permission + @pool_user2 = @pool_user2_permission.user + UserSession.create(@pool_user) + pool = Permission.first(:conditions => {:permission_object_type => 'Pool', :user_id => @pool_user.id}).permission_object + template = Factory.build(:template) + template.save! + hwp = Factory.build(:mock_hwp1) + hwp.save! + lambda do + post :create, :instance => { :name => 'mockinstance', + :pool_id => pool.id, + :template_id => template.id, + :hardware_profile_id => hwp.id } + end.should change(Instance, :count).by(1) + inst = Instance.find(:first, :conditions => ['name = ?', 'mockinstance']) + inst.permissions.size.should == 1 + inst.permissions[0].user.should == @pool_user + inst = Instance.list_for_user(@pool_user, Privilege::MODIFY, + :conditions => ['instances.name = :name', + {:name => 'mockinstance'}]).size.should == 1 + inst = Instance.list_for_user(@pool_user2, Privilege::MODIFY, + :conditions => ['instances.name = :name', + {:name => 'mockinstance'}]).size.should == 0 + + end end diff --git a/src/spec/factories/permission.rb b/src/spec/factories/permission.rb index f260ad7..7d988c5 100644 --- a/src/spec/factories/permission.rb +++ b/src/spec/factories/permission.rb @@ -23,5 +23,11 @@ end Factory.define :pool_user_permission, :parent => :permission do |p| p.role { |r| Role.first(:conditions => ['name = ?', 'Pool User']) || Factory(:role, :name => 'Pool User') } p.permission_object { |r| r.association(:pool) } - p.user { |u| u.association(:user) } + p.user { |u| u.association(:pool_user) } +end + +Factory.define :pool_user2_permission, :parent => :permission do |p| + p.role { |r| Role.first(:conditions => ['name = ?', 'Pool User']) || Factory(:role, :name => 'Pool User') } + p.permission_object { |r| r.association(:pool) } + p.user { |u| u.association(:pool_user2) } end diff --git a/src/spec/factories/user.rb b/src/spec/factories/user.rb index a9dd23e..2dc94f0 100644 --- a/src/spec/factories/user.rb +++ b/src/spec/factories/user.rb @@ -24,3 +24,8 @@ Factory.define :pool_user, :parent => :user do |u| u.sequence(:login) { |n| "pool_user#{n}" } u.email { |e| "#{e.login}(a)example.com" } end + +Factory.define :pool_user2, :parent => :user do |u| + u.sequence(:login) { |n| "pool_user2#{n}" } + u.email { |e| "#{e.login}(a)example.com" } +end -- 1.7.3.4

2 1

[PATCH] Update job submission format for new condor arrangement.
by Ian Main 31 Jan '11

31 Jan '11

The way jobs are submitted to condor has changed with the latest version. This patch formats the job appropriately for the new setup. Signed-off-by: Ian Main <imain(a)redhat.com> --- src/app/util/condormatic.rb | 27 ++++++++++++++++----------- 1 files changed, 16 insertions(+), 11 deletions(-) diff --git a/src/app/util/condormatic.rb b/src/app/util/condormatic.rb index 8b4e224..9908d56 100644 --- a/src/app/util/condormatic.rb +++ b/src/app/util/condormatic.rb @@ -44,22 +44,27 @@ def condormatic_instance_create(task) pipe.puts "executable = #{job_name}\n" Rails.logger.info "executable = #{job_name}\n" - resource = "grid_resource = dcloud $$(provider_url) $$(username) $$(password) $$(image_key) #{escape(instance.name)}" + pipe.puts "grid_resource = deltacloud $$(provider_url)\n" + Rails.logger.info "grid_resource = deltacloud $$(provider_url)\n" + pipe.puts "DeltacloudUsername = $$(username)\n" + Rails.logger.info "DeltacloudUsername = $$(username)\n" + pipe.puts "DeltacloudPassword = $$(password)\n" + Rails.logger.info "DeltacloudPassword = $$(password)\n" + pipe.puts "DeltacloudImageId = $$(image_key)\n" + Rails.logger.info "DeltacloudImageId = $$(image_key)\n" + pipe.puts "DeltacloudHardwareProfile = $$(hardwareprofile_key)\n" + Rails.logger.info "DeltacloudHardwareProfile = $$(hardwareprofile_key)\n" + pipe.puts "DeltacloudKeyname = $$(keypair)\n" + Rails.logger.info "DeltacloudKeyname = $$(keypair)\n" + if realm != nil - resource += " $$(realm_key)" + pipe.puts "DeltacloudRealmId = $$(realm_key)\n" + Rails.logger.info "DeltacloudRealmId = $$(realm_key)\n" else - resource += " NULL" - end - resource += " $$(hardwareprofile_key) $$(keypair) NULL\n" - - pipe.puts resource - Rails.logger.info resource requirements = "requirements = hardwareprofile == \"#{instance.hardware_profile.id}\" && image == \"#{instance.template.id}\"" requirements += " && realm == \"#{realm.id}\"" if realm != nil - # We may need to add some stuff to the provider classads like pool id, provider id etc. This is mostly just - # to test and make sure this works for now. - # + # This is currently broken as the condor plugin loads models without initializing rails. # However, recent changes have required that rails be initialized in order to load the # pool and quota models. -- 1.7.3.4

1 1

[PATCH aeolus] Added API call for matching hardware profiles
by Martyn Taylor 31 Jan '11

31 Jan '11

From: Martyn Taylor <mtaylor(a)redhat.com> --- .../admin/hardware_profiles_controller.rb | 14 +++++++++++++- 1 files changed, 13 insertions(+), 1 deletions(-) diff --git a/src/app/controllers/admin/hardware_profiles_controller.rb b/src/app/controllers/admin/hardware_profiles_controller.rb index dea2cac..d8de549 100644 --- a/src/app/controllers/admin/hardware_profiles_controller.rb +++ b/src/app/controllers/admin/hardware_profiles_controller.rb @@ -1,5 +1,5 @@ class Admin::HardwareProfilesController < ApplicationController - before_filter :require_user + before_filter :require_user, :except => :matching_profiles before_filter :set_params_and_header, :only => [:index, :show] before_filter :load_hardware_profiles, :only => [:index, :show] before_filter :load_hardware_profile, :only => [:show] @@ -98,6 +98,18 @@ class Admin::HardwareProfilesController < ApplicationController redirect_to admin_hardware_profiles_path end + def matching_profiles + begin + hwp = HardwareProfile.find(params[:id]) + hwps = HardwareProfile.matching_hwps(hwp) + render :layout => false, :xml => hwps.to_xml + rescue ActiveRecord::RecordNotFound + head :not_found + rescue Exception + head :internal_server_error + end + end + private def setup_new_hardware_profile if params[:hardware_profile] -- 1.7.3.4

2 1

[PATCH aeolus] Added API call for Quota check
by Martyn Taylor 31 Jan '11

31 Jan '11

From: Martyn Taylor <mtaylor(a)redhat.com> --- .../controllers/resources/instances_controller.rb | 28 +++++++++++++++++++- src/config/routes.rb | 5 +++- 2 files changed, 31 insertions(+), 2 deletions(-) diff --git a/src/app/controllers/resources/instances_controller.rb b/src/app/controllers/resources/instances_controller.rb index 9482a8d..5f2ccf8 100644 --- a/src/app/controllers/resources/instances_controller.rb +++ b/src/app/controllers/resources/instances_controller.rb @@ -1,5 +1,5 @@ class Resources::InstancesController < ApplicationController - before_filter :require_user + before_filter :require_user, :except => [:can_start, :can_create] before_filter :load_instance, :only => [:show, :remove_failed, :key, :stop] before_filter :set_view_vars, :only => [:show, :index] @@ -128,6 +128,32 @@ class Resources::InstancesController < ApplicationController redirect_to resources_instances_path end + def can_create + begin + cloud_account = CloudAccount.find(params[:cloud_account_id]) + instance = Instance.find(params[:instance_id]) + params = { :request => "can_create", :result => Quota.can_create_instance?(instance, cloud_account) } + render :layout => false, :xml => params.to_xml + rescue ActiveRecord::RecordNotFound + head :not_found + rescue Exception + head :internal_server_error + end + end + + def can_start + begin + cloud_account = CloudAccount.find(params[:cloud_account_id]) + instance = Instance.find(params[:instance_id]) + params = { :request => "can_start", :result => Quota.can_start_instance?(instance, cloud_account) } + render :layout => false, :xml => params.to_xml + rescue ActiveRecord::RecordNotFound + head :not_found + rescue Exception + head :internal_server_error + end + end + private def load_instance diff --git a/src/config/routes.rb b/src/config/routes.rb index 0aa281b..d920838 100644 --- a/src/config/routes.rb +++ b/src/config/routes.rb @@ -35,9 +35,12 @@ ActionController::Routing::Routes.draw do |map| map.namespace 'resources' do |r| r.resources :pools, :collection => { :multi_destroy => :delete } r.resources :deployments - r.resources :instances, :collection => {:start => :get, :stop => :get, :select_template => :get, :remove_failed => :get}, :member => {:key => :get} + r.resources :instances, :collection => {:start => :get, :stop => :get, :select_template => :get, :remove_failed => :get, :can_start => :get, :can_create => :get }, :member => {:key => :get} end + map.can_start_instance '/resources/instances/:instance_id/can_start/:cloud_account_id', :controller => 'resources/instances', :action => 'can_start', :conditions => { :method => :get } + map.can_create_instance '/resources/instances/:instance_id/can_create/:cloud_account_id', :controller => 'resources/instances', :action => 'can_create', :conditions => { :method => :get } + map.namespace 'image_factory' do |r| r.resources :assemblies r.resources :deployables, :collection => { :multi_destroy => :delete } -- 1.7.3.4

2 1

[PATCH aeolus] Added API call for Quota check
by Martyn Taylor 27 Jan '11

27 Jan '11

From: Martyn Taylor <mtaylor(a)redhat.com> --- src/app/controllers/quotas_controller.rb | 27 ++++++++++++++++++++++++++- 1 files changed, 26 insertions(+), 1 deletions(-) diff --git a/src/app/controllers/quotas_controller.rb b/src/app/controllers/quotas_controller.rb index e9937fb..26a8f15 100644 --- a/src/app/controllers/quotas_controller.rb +++ b/src/app/controllers/quotas_controller.rb @@ -72,6 +72,32 @@ class QuotasController < ApplicationController redirect_to :action => 'show', :id => @parent, :parent_type => @parent_type end + def can_create_instance + begin + cloud_account = CloudAccount.find(params[:cloud_account_id]) + instance = Instance.find(params[:instance_id]) + params = { :request => "can_create_instance", :result => Quota.can_create_instance?(instance, cloud_account) } + render :layout => false, :xml => params.to_xml + rescue ActiveRecord::RecordNotFound + head :not_found + rescue Exception + head :internal_server_error + end + end + + def can_start_instance + begin + cloud_account = CloudAccount.find(params[:cloud_account_id]) + instance = Instance.find(params[:instance_id]) + params = { :request => "can_start_instance", :result => Quota.can_start_instance?(instance, cloud_account) } + render :layout => false, :xml => params.to_xml + rescue ActiveRecord::RecordNotFound + head :not_found + rescue Exception + head :internal_server_error + end + end + private def get_parent_object(params) if params[:parent_type] == "pool" @@ -100,5 +126,4 @@ class QuotasController < ApplicationController return params end - end -- 1.7.3.4

2 1

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

aeolus-devel January 2011