Skip to content

Commit a5014a2

Browse files
weizhouapacheweizhouapache
authored
New feature: give access permission of networks to other accounts in same domain (#5769)
* Enhancement: create Shared networks and VPC private gateways by users * UI bug fix: pass correct domainid in CreateSharedNetworkForm * Update #5730: fix test failure with test_guest_vlan_range.py * Update #5730: fix test failure with test_persistent_network.py * Update #5730: Add since to new API commands and API parameters * Update #5730: Get first physical network for VPC private gateway if other ways do not work * Update #5730: code optimization (return !offering.isSpecifyVlan()) * Update #5730: fix hard-coded network offering id in test_pvlan.py * Update #5730: skip access check on the network owner if the owner is ROOT/system * Update #5730: overlap check on cidr/startip/endip * Update #5730: add methods to get accountid/domainid of shared networks * Update #5730: improve integration tests * Update #5730: update as per GutoVeronezi's comments * Network Sharing: give network access permission to other accounts within a domain * network: update ip in lb/pf/dnat tables when update vm nic ip * Update #5757: create 3 separated methods for DNAT/LB/PF update * travis: install python3-setuptools * Network Sharing: update integration test * Update #5769: Remove NetworkPermission.Ops * Update #5769: Update as per Daan's comments * Update #5769: Update as per Suresh's comments * Update #5769: fix UI bug that accounts/projects are not listed * Update #5769: fix domain admin can deploy vm on L2 network of other users * Update #5769: Remove method listPermittedNetworkIdsByDomains in NetworkPermissionDao * Update #5769: Skip network operation permissions check for root admin * UI: fix create Isolated/L2 network form * Update #5730: fix create Shared network form * Update #5769: fix domain admin can deploy vm on L2 network of other users * test: fix test_storage_policy.py * Update #5769: fix remove_nic in test_network_permissions.py * Update #5769: extract some codes to a method * Update #5769: fix add/remove nic by domain admin * Update #5769: allow domain admin to enable/disable static nat and create port forwarding rules * Update #5769: update integration test * Update #5769: fix unit test AssignLoadBalancerTest.java * Update #5769: allow normal users to share network permission to other users on UI * Update #5769: fix small UI bug with label * Update #5769: Support L2 network as associated network * test: sleep 30s after restarting mgt server in test_kubernetes_supported_versions.py to fix test failures with test_secondary_storage.py * Update #5784: revert part of changes in #2420 * Update #5757: invert if condition to reduce code indentation * Update #5769: fix regular user cannot create L2 network * Update #5769: Add associated nework id and name in private gateway response * Update #5769: list networks by networkfilter=Account on UI * Update #5769: fix ui issue when list private gateways or create shared network if no isolated networks * Update #5769: fix vue ui warnings * Update #5679: add BaseResponseWithAssociatedNetwork and extract method setResponseAssociatedNetworkInformation * Update #5679: extract some methods in VpcManagerImpl.java * Update #5679: Update smoke tests as per Daan's comments * Update #5769: fix vpc with private gateways cannot be removed when remove an acount * Update #5769: fix unit test failures after merging latest main * Update #5769: fix schema-41610to41700.sql * Update #5769: fix Request failed due to empty network offering list on UI * Update #5769: Throw exception when account is not found by name * Update #5769: display a warning message if network offering list is empty * Update #5769: fix an UI bug caused by previous commit b286cb7 * Update #5769: fix UI bugs due to vue3 merge * Update #5769: fix issue due to account type refactoring * Update #5769: fix ui bugs due to vue3 * Update #5769: fix issue due to vue3 upgrade * Update #5769: fix issue due to vue3 upgrade part 2 * Update #5769: fix issue due to vue3 upgrade part 3 * Update #5769: highlight default scope when create shared network on UI * Update #5769: fix domain list is not loaded on UI * Update #5769: fix restart/delete shared network by normal users * Update #5769: fix restart domain-scope shared network by domain admin * Update #5769: fix 3 UI bugs (1) double networks in list; (2) icon of first items in list; (3) account/project autoselect * Update #5769: fix 2 ui bugs; (1) selected project is not changed when change domain; (2) no network should be selected by default * Update #5769: fix update shared networks by domain admin/regular user * Update #5769: fix Flicking warning message about the empty network offerings * Update #5769: display associated network name in shared network info card * Update #5769: fix create private gateway form * Update #5769: fix network lists in project view * Update #5769: fix duplicated networks in network dropdown * Update #5769: fix failed to create shared network if associated L2 network is Setup * Update #5769: check AccessType.OperateEntry on network in its implementation * Revert "Update #5769: check AccessType.OperateEntry on network in its implementation" This reverts commit c42c489. * Update #5769: fix keyword search in list guest vlans
1 parent 334891a commit a5014a2

86 files changed

Lines changed: 5589 additions & 532 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎api/src/main/java/com/cloud/network/GuestVlan.java‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,17 +16,26 @@
1616
// under the License.
1717
package com.cloud.network;
1818

19-
import org.apache.cloudstack.api.Identity;
2019
import org.apache.cloudstack.api.InternalIdentity;
2120

22-
public interface GuestVlan extends InternalIdentity, Identity {
21+
import java.util.Date;
22+
23+
public interface GuestVlan extends InternalIdentity {
2324

2425
@Override
2526
public long getId();
2627

27-
public long getAccountId();
28+
Date getTakenAt();
29+
30+
String getVnet();
31+
32+
String getReservationId();
33+
34+
Long getAccountId();
35+
36+
long getDataCenterId();
2837

29-
public String getGuestVlanRange();
38+
long getPhysicalNetworkId();
3039

31-
public long getPhysicalNetworkId();
40+
Long getAccountGuestVlanMapId();
3241
}

‎api/src/main/java/com/cloud/network/GuestVlanRange.java‎

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,32 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package com.cloud.network;
18+
19+
import org.apache.cloudstack.api.Identity;
20+
import org.apache.cloudstack.api.InternalIdentity;
21+
22+
public interface GuestVlanRange extends InternalIdentity, Identity {
23+
24+
@Override
25+
public long getId();
26+
27+
public long getAccountId();
28+
29+
public String getGuestVlanRange();
30+
31+
public long getPhysicalNetworkId();
32+
}

‎api/src/main/java/com/cloud/network/Network.java‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -332,6 +332,14 @@ private State(String description) {
332332
}
333333
}
334334

335+
public enum NetworkFilter {
336+
Account, // return account networks that have been registered for or created by the calling user
337+
Domain, // return domain networks that have been registered for or created by the calling user
338+
AccountDomain, // return account and domain networks that have been registered for or created by the calling user
339+
Shared, // including networks that have been granted to the calling user by another user
340+
All // all networks (account, domain and shared)
341+
}
342+
335343
public class IpAddresses {
336344
private String ip4Address;
337345
private String ip6Address;
@@ -372,6 +380,8 @@ public void setIp6Address(String ip6Address) {
372380
}
373381
}
374382

383+
static final String AssociatedNetworkId = "AssociatedNetworkId";
384+
375385
String getName();
376386

377387
Mode getMode();

‎api/src/main/java/com/cloud/network/NetworkModel.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@
3535
import com.cloud.network.Networks.TrafficType;
3636
import com.cloud.network.element.NetworkElement;
3737
import com.cloud.network.element.UserDataServiceProvider;
38+
import com.cloud.network.router.VirtualRouter;
3839
import com.cloud.offering.NetworkOffering;
3940
import com.cloud.offering.NetworkOffering.Detail;
4041
import com.cloud.user.Account;
@@ -195,6 +196,10 @@ public interface NetworkModel {
195196

196197
void checkNetworkPermissions(Account owner, Network network);
197198

199+
void checkNetworkOperatePermissions(Account owner, Network network);
200+
201+
void checkRouterPermissions(Account owner, VirtualRouter router);
202+
198203
String getDefaultManagementTrafficLabel(long zoneId, HypervisorType hypervisorType);
199204

200205
String getDefaultStorageTrafficLabel(long zoneId, HypervisorType hypervisorType);

‎api/src/main/java/com/cloud/network/NetworkPermission.java‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package com.cloud.network;
18+
19+
import org.apache.cloudstack.api.InternalIdentity;
20+
21+
public interface NetworkPermission extends InternalIdentity {
22+
23+
long getNetworkId();
24+
25+
long getAccountId();
26+
}

‎api/src/main/java/com/cloud/network/NetworkService.java‎

Lines changed: 18 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,9 +22,14 @@
2222
import org.apache.cloudstack.api.command.admin.address.ReleasePodIpCmdByAdmin;
2323
import org.apache.cloudstack.api.command.admin.network.DedicateGuestVlanRangeCmd;
2424
import org.apache.cloudstack.api.command.admin.network.ListDedicatedGuestVlanRangesCmd;
25+
import org.apache.cloudstack.api.command.admin.network.ListGuestVlansCmd;
2526
import org.apache.cloudstack.api.command.admin.usage.ListTrafficTypeImplementorsCmd;
2627
import org.apache.cloudstack.api.command.user.network.CreateNetworkCmd;
28+
import org.apache.cloudstack.api.command.user.network.CreateNetworkPermissionsCmd;
29+
import org.apache.cloudstack.api.command.user.network.ListNetworkPermissionsCmd;
2730
import org.apache.cloudstack.api.command.user.network.ListNetworksCmd;
31+
import org.apache.cloudstack.api.command.user.network.RemoveNetworkPermissionsCmd;
32+
import org.apache.cloudstack.api.command.user.network.ResetNetworkPermissionsCmd;
2833
import org.apache.cloudstack.api.command.user.network.RestartNetworkCmd;
2934
import org.apache.cloudstack.api.command.user.network.UpdateNetworkCmd;
3035
import org.apache.cloudstack.api.command.user.vm.ListNicsCmd;
@@ -148,9 +153,9 @@ PhysicalNetworkTrafficType addTrafficTypeToPhysicalNetwork(Long physicalNetworkI
148153

149154
boolean deletePhysicalNetworkTrafficType(Long id);
150155

151-
GuestVlan dedicateGuestVlanRange(DedicateGuestVlanRangeCmd cmd);
156+
GuestVlanRange dedicateGuestVlanRange(DedicateGuestVlanRangeCmd cmd);
152157

153-
Pair<List<? extends GuestVlan>, Integer> listDedicatedGuestVlanRanges(ListDedicatedGuestVlanRangesCmd cmd);
158+
Pair<List<? extends GuestVlanRange>, Integer> listDedicatedGuestVlanRanges(ListDedicatedGuestVlanRangesCmd cmd);
154159

155160
boolean releaseDedicatedGuestVlanRange(Long dedicatedGuestVlanRangeId);
156161

@@ -184,7 +189,7 @@ IpAddress associateIPToNetwork(long ipId, long networkId) throws InsufficientAdd
184189
* @throws ResourceAllocationException
185190
*/
186191
Network createPrivateNetwork(String networkName, String displayText, long physicalNetworkId, String broadcastUri, String startIp, String endIP, String gateway,
187-
String netmask, long networkOwnerId, Long vpcId, Boolean sourceNat, Long networkOfferingId, Boolean bypassVlanOverlapCheck) throws ResourceAllocationException, ConcurrentOperationException,
192+
String netmask, long networkOwnerId, Long vpcId, Boolean sourceNat, Long networkOfferingId, Boolean bypassVlanOverlapCheck, Long associatedNetworkId) throws ResourceAllocationException, ConcurrentOperationException,
188193
InsufficientCapacityException;
189194

190195
/**
@@ -210,4 +215,14 @@ Network createPrivateNetwork(String networkName, String displayText, long physic
210215
AcquirePodIpCmdResponse allocatePodIp(Account account, String zoneId, String podId) throws ResourceAllocationException, ConcurrentOperationException;
211216

212217
boolean releasePodIp(ReleasePodIpCmdByAdmin ip) throws CloudRuntimeException;
218+
219+
Pair<List<? extends GuestVlan>, Integer> listGuestVlans(ListGuestVlansCmd cmd);
220+
221+
List<? extends NetworkPermission> listNetworkPermissions(ListNetworkPermissionsCmd listNetworkPermissionsCmd);
222+
223+
boolean createNetworkPermissions(CreateNetworkPermissionsCmd createNetworkPermissionsCmd);
224+
225+
boolean removeNetworkPermissions(RemoveNetworkPermissionsCmd removeNetworkPermissionsCmd);
226+
227+
boolean resetNetworkPermissions(ResetNetworkPermissionsCmd resetNetworkPermissionsCmd);
213228
}

‎api/src/main/java/com/cloud/network/vpc/VpcService.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,7 @@
1919
import java.util.List;
2020
import java.util.Map;
2121

22+
import org.apache.cloudstack.api.command.user.vpc.CreatePrivateGatewayCmd;
2223
import org.apache.cloudstack.api.command.user.vpc.ListPrivateGatewaysCmd;
2324
import org.apache.cloudstack.api.command.user.vpc.ListStaticRoutesCmd;
2425
import org.apache.cloudstack.api.command.user.vpc.RestartVPCCmd;
@@ -165,8 +166,7 @@ public Pair<List<? extends Vpc>, Integer> listVpcs(Long id, String vpcName, Stri
165166
* @throws ConcurrentOperationException
166167
* @throws ResourceAllocationException
167168
*/
168-
public PrivateGateway createVpcPrivateGateway(long vpcId, Long physicalNetworkId, String vlan, String ipAddress, String gateway, String netmask, long gatewayOwnerId,
169-
Long networkOfferingId, Boolean isSoruceNat, Long aclId, Boolean bypassVlanOverlapCheck) throws ResourceAllocationException, ConcurrentOperationException, InsufficientCapacityException;
169+
public PrivateGateway createVpcPrivateGateway(CreatePrivateGatewayCmd command) throws ResourceAllocationException, ConcurrentOperationException, InsufficientCapacityException;
170170

171171
/**
172172
* Applies VPC private gateway on the backend, so it becomes functional

‎api/src/main/java/com/cloud/offering/NetworkOffering.java‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,7 @@ public enum Detail {
4848
public final static String SystemManagementNetwork = "System-Management-Network";
4949
public final static String SystemStorageNetwork = "System-Storage-Network";
5050
public final static String SystemPrivateGatewayNetworkOffering = "System-Private-Gateway-Network-Offering";
51+
public final static String SystemPrivateGatewayNetworkOfferingWithoutVlan = "System-Private-Gateway-Network-Offering-Without-Vlan";
5152

5253
public final static String DefaultSharedNetworkOfferingWithSGService = "DefaultSharedNetworkOfferingWithSGService";
5354
public final static String QuickCloudNoServices = "QuickCloudNoServices";

‎api/src/main/java/org/apache/cloudstack/api/ApiConstants.java‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@ public class ApiConstants {
2121
public static final String ACCOUNTS = "accounts";
2222
public static final String ACCOUNT_TYPE = "accounttype";
2323
public static final String ACCOUNT_ID = "accountid";
24+
public static final String ACCOUNT_IDS = "accountids";
2425
public static final String ACCUMULATE = "accumulate";
2526
public static final String ACTIVITY = "activity";
2627
public static final String ADAPTER_TYPE = "adaptertype";
@@ -422,6 +423,8 @@ public class ApiConstants {
422423
public static final String ISOLATED_PVLAN = "isolatedpvlan";
423424
public static final String ISOLATED_PVLAN_TYPE = "isolatedpvlantype";
424425
public static final String ISOLATION_URI = "isolationuri";
426+
public static final String IS_DEDICATED = "isdedicated";
427+
public static final String TAKEN = "taken";
425428
public static final String VM_AVAILABLE = "vmavailable";
426429
public static final String VM_LIMIT = "vmlimit";
427430
public static final String VM_TOTAL = "vmtotal";
@@ -441,6 +444,7 @@ public class ApiConstants {
441444
public static final String TIER_NETWORK_OFFERINGS = "tiernetworkofferings";
442445
public static final String NETWORK_IDS = "networkids";
443446
public static final String NETWORK_ID = "networkid";
447+
public static final String NETWORK_FILTER = "networkfilter";
444448
public static final String NIC_ID = "nicid";
445449
public static final String SPECIFY_VLAN = "specifyvlan";
446450
public static final String IS_DEFAULT = "isdefault";
@@ -536,6 +540,7 @@ public class ApiConstants {
536540
public static final String ISOLATION_METHOD = "isolationmethod";
537541
public static final String ISOLATION_METHODS = "isolationmethods";
538542
public static final String PHYSICAL_NETWORK_ID = "physicalnetworkid";
543+
public static final String PHYSICAL_NETWORK_NAME = "physicalnetworkname";
539544
public static final String DEST_PHYSICAL_NETWORK_ID = "destinationphysicalnetworkid";
540545
public static final String ENABLE = "enable";
541546
public static final String ENABLED = "enabled";
@@ -572,6 +577,7 @@ public class ApiConstants {
572577
public static final String FIREWALL_DEVICE_CAPACITY = "fwdevicecapacity";
573578
public static final String FIREWALL_DEVICE_DEDICATED = "fwdevicededicated";
574579
public static final String SERVICE = "service";
580+
public static final String ASSOCIATED_NETWORK = "associatednetwork";
575581
public static final String ASSOCIATED_NETWORK_ID = "associatednetworkid";
576582
public static final String ASSOCIATED_NETWORK_NAME = "associatednetworkname";
577583
public static final String SOURCE_NAT_SUPPORTED = "sourcenatsupported";

‎api/src/main/java/org/apache/cloudstack/api/BaseResponseWithAssociatedNetwork.java‎

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
// Licensed to the Apache Software Foundation (ASF) under one
2+
// or more contributor license agreements. See the NOTICE file
3+
// distributed with this work for additional information
4+
// regarding copyright ownership. The ASF licenses this file
5+
// to you under the Apache License, Version 2.0 (the
6+
// "License"); you may not use this file except in compliance
7+
// with the License. You may obtain a copy of the License at
8+
//
9+
// http://www.apache.org/licenses/LICENSE-2.0
10+
//
11+
// Unless required by applicable law or agreed to in writing,
12+
// software distributed under the License is distributed on an
13+
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
14+
// KIND, either express or implied. See the License for the
15+
// specific language governing permissions and limitations
16+
// under the License.
17+
package org.apache.cloudstack.api;
18+
19+
import com.cloud.serializer.Param;
20+
import com.google.gson.annotations.SerializedName;
21+
22+
public abstract class BaseResponseWithAssociatedNetwork extends BaseResponseWithAnnotations {
23+
24+
@SerializedName(ApiConstants.ASSOCIATED_NETWORK_ID)
25+
@Param(description = "the ID of the Network associated with this private gateway")
26+
private String associatedNetworkId;
27+
28+
@SerializedName(ApiConstants.ASSOCIATED_NETWORK)
29+
@Param(description = "the name of the Network associated with this private gateway")
30+
private String associatedNetworkName;
31+
32+
public void setAssociatedNetworkId(String associatedNetworkId) {
33+
this.associatedNetworkId = associatedNetworkId;
34+
}
35+
36+
public void setAssociatedNetworkName(String associatedNetworkName) {
37+
this.associatedNetworkName = associatedNetworkName;
38+
}
39+
40+
}

0 commit comments

Comments
 (0)