weizhouapache opened a new pull request, #14071: URL: https://github.com/apache/cloudstack/pull/14071
### Description `createVolume` accepts an admin-only `storageid` parameter to create the volume directly on a specified storage pool. Unlike the normal allocation path (which goes through `StoragePoolAllocator` → `StorageManager.storagePoolHasEnoughSpace` → `checkUsagedSpace`), this path fetched the pool directly by ID and only validated pool status, zone match, and disk-offering compatibility — it never checked the pool's storage capacity disable threshold (`storage.capacity.disablethreshold`) or allocated-capacity disable threshold before creating the volume there. This means an admin passing `storageid` could push a storage pool past its configured disable threshold, defeating the safety mechanism the threshold exists for. This is not considered a security issue since the `storageid` parameter is restricted to `RoleType.Admin` (added in 4.22.1), but it is a correctness bug. ### Fix `VolumeApiServiceImpl#createVolumeOnStoragePool` now calls `StorageManager#storagePoolHasEnoughSpace` (the same check used by `migrateVolume`) before handing the volume off to `VolumeService#createVolumeAsync`, and rejects the request with an `InvalidParameterValueException` if the pool has crossed its disable threshold or doesn't have enough space. ### Types of changes - [x] Bugfix (non-breaking change which fixes an issue) ### Feature/Enhancement Scale or Bug Severity Bug Severity: Minor ### Screenshots (if appropriate): N/A ### How Has This Been Tested? Added unit tests to `VolumeApiServiceImplTest`: - `testCreateVolumeOnStoragePool_DisableThresholdCrossed_ShouldThrow` — verifies an `InvalidParameterValueException` is thrown and `createVolumeAsync` is never invoked when the pool has crossed its disable threshold. - `testCreateVolumeOnStoragePool_EnoughSpace_ShouldCreateVolume` — verifies the volume is created normally when the pool has enough space. Ran the full `VolumeApiServiceImplTest` suite (161 tests, 0 failures). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
