You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 3 Next »

Bug Reference

CLOUDSTACK-1390

Branch

master, 4.2.0

Purpose

In CloudStack today, a User VM can be moved to another user under the same domain i.e. Admin can create a VM and assign it to an Account as long as the account belongs to the same domain as admin

CloudStack should allow Root/Domain admin to move a User VM to another user under a different domain

Use cases

  1. Admin creates on behalf of another user and then assigns it the user. In a traditional enterprise, regular user may go to a service desk portal, request a marketing campaign application to be deployed. The admin might create a one or more VMs, setup the app, and turn it over the Line of Business User - in this case, we don't want to see every VM be assigned to admins only - this will create issues with billing etc.
  2. A developer has a bunch of VMs and he leaves the team/company - but, the manager wants to retain those work VMs or reassign it to another developer.

Scope

Say we have the following domains and subdomains - Root/Domain1, Root/Domain2, Root/Domain1/Subdomain1 and Root/Domain1/Subdomain2.

Root admin should be allowed to move User VM’s from,

  • account in Domain1 to account in Domain2
  • account in Domain1 to account in Subdomain1
  • account in Domain1 to an account in the subdomain of Subdomain1
  • account in Subdomain1 to account in Domain1 

Both Root and Domain admin should be allowed to move User VM’s from,

  • account in Subdomain1 to account in Subdomain2 

Keeping with the current behavior in CloudStack,

  • If VM is in Running state then fail the request
  • If VM belongs to a project then fail the request
  • If VM has any PF/LB/Static NAT rules present then fail the request
  • All volumes attached to the VM will be moved to the new owner
  • All existing snapshots of the volumes attached to VM will be marked as removed
  • If the account the VM is being moved to doesn't have access to the VM template then fail the request
  • If the account the VM is being moved to has no guest networks a new network will be created 

Web Services APIs

  • There will not be any API changes as the existing assignVirtualMachine API will be used to move the user between accounts under different domains.

DB

  • No DB changes 
  • No labels