Include an authorization plugin that prevents users from overriding scheduler decisions
|Assignee:||Javi Fontan||% Done:|
|Category:||Drivers - Auth|
|Target version:||Release 3.0|
When OpenNebula runs with Haizea as a scheduling backend, if a request is denied or postponed, a user can still override the scheduler by manually running "onevm deploy". This is actually also an issue when running with the default scheduler.
The OpenNebula team has stated that this could be solved by writing an authorization plugin that restricts "deploy" permissions to only oneadmin (which would work with Haizea, since Haizea uses the oneadmin account to deploy VMs). This seems like a big enough gap that OpenNebula should just include such a plugin by default, giving administrators the option to enable it if they want to prevent users from running "onevm deploy" on their own.
Of course, we could think of fancier schemes down the road (where administrators can specify specific privileges and assign them to certain users, or even groups of users, but not to others) but, for now, I believe that just a plugin included with the regular OpenNebula distribution would be enough.
#2 Updated by Zaina Afoulki over 8 years ago
+1 for this
I agree with Borja on implementing this feature. I believe it is a major issue.
Another related thing is: when Haizea or the default scheduler refuses/denies a lease, its STATE remains "pend" with "onevm list". I think it should change to "fail" or another status or even better be removed from the list showed by OpenNebula (there is no use in keeping it in the list).