You have to perform the API as admin - are you doing so? On Wed, 2 Oct 2019 at 11:34, Ugo Vasi <[email protected]> wrote:
> Hi all, > I need to move a VM created by admin user of the ROOT domain to a new > account of sub-account (Test-2/user01) but the procedure fails with this > error message: > > Failed to move vm Acct[0efe4d3e...] does not have permission to operate > within domain id=165f090c-... > > Here it is the Management log: > > 2019-10-02 10:42:05,222 DEBUG [c.c.a.ApiServer] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) CIDRs from > which account 'Acct[4c0483a8-...-admin]' is allowed to perform API calls: > 0.0.0.0/0,::/0 > 2019-10-02 <http://0.0.0.0/0,::/02019-10-02> 10:42:05,238 DEBUG > [c.c.u.AccountManagerImpl] (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) > (logid:bca11f53) Access granted to Acct[4c0483a8-...-admin] to > Domain:4/Test-2/ by AffinityGroupAccessChecker > 2019-10-02 10:42:05,256 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > amount of resources of Type = 'user_vm' for Account Name = user01 in Domain > Id = 4 is exceeded: Account Resource Limit = 2, Current Account Resource > Amount = 1, Requested Resource Amount = 1. > 2019-10-02 10:42:05,258 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > domain resource limits of Type 'user_vm' for Domain Id = 4 is exceeded: > Domain Resource Limit = 3, Current Domain Resource Amount = 1, Requested > Resource Amount = 1. > 2019-10-02 10:42:05,265 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > amount of resources of Type = 'cpu' for Account Name = user01 in Domain Id > = 4 is exceeded: Account Resource Limit = 2, Current Account Resource > Amount = 1, Requested Resource Amount = 1. > 2019-10-02 10:42:05,267 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > domain resource limits of Type 'cpu' for Domain Id = 4 is exceeded: Domain > Resource Limit = 6, Current Domain Resource Amount = 1, Requested Resource > Amount = 1. > 2019-10-02 10:42:05,275 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > amount of resources of Type = 'memory' for Account Name = user01 in Domain > Id = 4 is exceeded: Account Resource Limit = 2048, Current Account Resource > Amount = 1024, Requested Resource Amount = 1024. > 2019-10-02 10:42:05,278 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > domain resource limits of Type 'memory' for Domain Id = 4 is exceeded: > Domain Resource Limit = 4096, Current Domain Resource Amount = 1024, > Requested Resource Amount = 1024. > 2019-10-02 10:42:05,285 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > amount of resources of Type = 'volume' for Account Name = user01 in Domain > Id = 4 is exceeded: Account Resource Limit = 2, Current Account Resource > Amount = 1, Requested Resource Amount = 1. > 2019-10-02 10:42:05,287 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > domain resource limits of Type 'volume' for Domain Id = 4 is exceeded: > Domain Resource Limit = 3, Current Domain Resource Amount = 1, Requested > Resource Amount = 1. > 2019-10-02 10:42:05,294 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > amount of resources of Type = 'primary_storage' for Account Name = user01 > in Domain Id = 4 is exceeded: Account Resource Limit = 107374182400, > Current Account Resource Amount = 8589934592, Requested Resource Amount = > 6442450944. > 2019-10-02 10:42:05,296 DEBUG [c.c.r.ResourceLimitManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Checking if > domain resource limits of Type 'primary_storage' for Domain Id = 4 is > exceeded: Domain Resource Limit = 107374182400, Current Domain Resource > Amount = 8589934592, Requested Resource Amount = 6442450944. > 2019-10-02 10:42:05,300 DEBUG [c.c.u.AccountManagerImpl] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Access to > Acct[4c0483a8-...-admin] granted to Acct[0efe4d3e-...-user01] by > DomainChecker > 2019-10-02 10:42:05,313 INFO [c.c.a.ApiServer] > (qtp1096283470-7276:ctx-fb7b8bb0 ctx-20aee882) (logid:bca11f53) Failed to > move vm Acct[0efe4d3e-...-user01] does not have permission to operate > within domain id=165f090c-... > > I tryed to do the same procedure with a similar situatuation in a test > environment and it work as aspected... > > The main installation is a cloudstack 4.11.2 and the test installation > is a 4.11.3 (both kvm hypervisor). > > > Where can I look for the problem? > > -- > > *Ugo Vasi* / System Administrator > [email protected] <mailto:[email protected]> > > > > > *Procne S.r.l.* > +39 0432 486 523 > via Cotonificio, 45 > 33010 Tavagnacco (UD) > www.procne.it <http://www.procne.it/> > > > Le informazioni contenute nella presente comunicazione ed i relativi > allegati possono essere riservate e sono, comunque, destinate > esclusivamente alle persone od alla Società sopraindicati. La > diffusione, distribuzione e/o copiatura del documento trasmesso da parte > di qualsiasi soggetto diverso dal destinatario è proibita sia ai sensi > dell'art. 616 c.p., che ai sensi del Decreto Legislativo n. 196/2003 > "Codice in materia di protezione dei dati personali". Se avete ricevuto > questo messaggio per errore, vi preghiamo di distruggerlo e di informare > immediatamente Procne S.r.l. scrivendo all' indirizzo e-mail > [email protected] <mailto:[email protected]>. > > -- Andrija Panić
