Re: [Xen-API] assert_can_migrate regression

[Thomas Gazagnaire <thomas@xxxxxxxxxxxxxx>]

> I think we could add "/services/xenops" as a first-class handler in the web 
> server rather than overload the "/services" one.
> 
> In general I think it was a mistake to use 2 levels of dispatch: one using a 
> prefix trie in the web server and the other in the pattern match. We should 
> just use the prefix trie throughout.
> 
> Will that help fix your issue?

I'm not sure to understand. If it becomes a first-class handler, then you mean 
it is safe to change the RBAC permission for this service (to allow VM admins 
to use it) ?

--
Thomas

> 
> -- 
> Dave Scott
> XenServer System Architect
> 
> On Jun 29, 2012, at 11:49 AM, "Thomas Gazagnaire" <thomas@xxxxxxxxxxxxxx> 
> wrote:
> 
>> Hi,
>> 
>> I found an other regression: only pool admins are now allowed to migrate 
>> VMs. This is because the new migrate codepath is now using the 
>> /services/xenops url (to communicate between xenops deamons) which can be 
>> used by pool admins only, whereas migration was previously using the 
>> /migrate url, which can be used by all VM admins.
>> 
>> So I can think of two possibles fixes for that regression:
>> * either allow services/xenops to VM admins (this can lead to some security 
>> issues if not done correctly)
>> * or use the old /migrate url for VM migrations (this can be quite intrusive 
>> I guess, as we need to check that every xenops client done by xenops use 
>> this codepath)
>> 
>> What do you advice ?
>> 
>> --
>> Thomas
>> 
>> On Jun 27, 2012, at 6:06 PM, Dave Scott wrote:
>> 
>>> Hi Thomas,
>>> 
>>> That sounds like an oversight. I think it would be good to add it back in 
>>> migrate_send.
>>> 
>>> Cheers,
>>> Dave
>>>> -----Original Message-----
>>>> From: xen-api-bounces@xxxxxxxxxxxxx [mailto:xen-api-
>>>> bounces@xxxxxxxxxxxxx] On Behalf Of Thomas Gazagnaire
>>>> Sent: 27 June 2012 16:54
>>>> To: xen-api@xxxxxxxxxxxxx
>>>> Subject: [Xen-API] assert_can_migrate regression
>>>> 
>>>> Hi all,
>>>> 
>>>> It seems that xapi/Xapi_vm_migrate.assert_can_migrate is not called
>>>> anymore before the migration process.
>>>> 
>>>> I guess we should add it again somewhere in the body of migrate_send
>>>> for instance. Does it make sense or did I miss something obvious here ?
>>>> 
>>>> --
>>>> Thomas
>>>> 
>>>> 
>>>> 
>>>> _______________________________________________
>>>> Xen-api mailing list
>>>> Xen-api@xxxxxxxxxxxxx
>>>> http://lists.xen.org/cgi-bin/mailman/listinfo/xen-api
>> 


_______________________________________________
Xen-api mailing list
Xen-api@xxxxxxxxxxxxx
http://lists.xen.org/cgi-bin/mailman/listinfo/xen-api