2626import java .util .List ;
2727import java .util .Map ;
2828import java .util .Objects ;
29- import java .util .UUID ;
3029import java .util .concurrent .TimeUnit ;
3130import java .util .stream .Collectors ;
3231
3332import javax .inject .Inject ;
3433
35- import org .apache .cloudstack .acl .Role ;
36- import org .apache .cloudstack .acl .RolePermissionEntity ;
37- import org .apache .cloudstack .acl .RoleService ;
38- import org .apache .cloudstack .acl .RoleType ;
39- import org .apache .cloudstack .acl .Rule ;
4034import org .apache .cloudstack .acl .SecurityChecker ;
4135import org .apache .cloudstack .affinity .AffinityGroupVO ;
4236import org .apache .cloudstack .affinity .dao .AffinityGroupDao ;
5852import org .apache .cloudstack .api .command .admin .vm .DeployVMCmdByAdmin ;
5953import org .apache .cloudstack .api .command .user .backup .ListBackupsCmd ;
6054import org .apache .cloudstack .api .command .user .job .ListAsyncJobsCmd ;
61- import org .apache .cloudstack .api .command .user .job .QueryAsyncJobResultCmd ;
6255import org .apache .cloudstack .api .command .user .network .ListNetworksCmd ;
6356import org .apache .cloudstack .api .command .user .offering .ListServiceOfferingsCmd ;
6457import org .apache .cloudstack .api .command .user .tag .ListTagsCmd ;
7770import org .apache .cloudstack .api .command .user .volume .AssignVolumeCmd ;
7871import org .apache .cloudstack .api .command .user .volume .AttachVolumeCmd ;
7972import org .apache .cloudstack .api .command .user .volume .CreateVolumeCmd ;
80- import org .apache .cloudstack .api .command .user .volume .DeleteVolumeCmd ;
8173import org .apache .cloudstack .api .command .user .volume .DestroyVolumeCmd ;
82- import org .apache .cloudstack .api .command .user .volume .DetachVolumeCmd ;
8374import org .apache .cloudstack .api .command .user .volume .ListVolumesCmd ;
84- import org .apache .cloudstack .api .command .user .volume .ResizeVolumeCmd ;
8575import org .apache .cloudstack .api .command .user .volume .UpdateVolumeCmd ;
8676import org .apache .cloudstack .api .command .user .zone .ListZonesCmd ;
8777import org .apache .cloudstack .api .response .ListResponse ;
10090import org .apache .cloudstack .storage .datastore .db .PrimaryDataStoreDao ;
10191import org .apache .cloudstack .storage .datastore .db .StoragePoolVO ;
10292import org .apache .cloudstack .veeam .VeeamControlService ;
103- import org .apache .cloudstack .veeam .api .TagsRouteHandler ;
10493import org .apache .cloudstack .veeam .api .converter .AsyncJobJoinVOToJobConverter ;
10594import org .apache .cloudstack .veeam .api .converter .BackupVOToBackupConverter ;
10695import org .apache .cloudstack .veeam .api .converter .ClusterVOToClusterConverter ;
190179import com .cloud .user .AccountService ;
191180import com .cloud .user .DomainService ;
192181import com .cloud .user .User ;
193- import com .cloud .user .UserAccount ;
194182import com .cloud .user .UserDataVO ;
195183import com .cloud .user .dao .UserDataDao ;
196184import com .cloud .uservm .UserVm ;
211199import com .cloud .vm .snapshot .VMSnapshotVO ;
212200import com .cloud .vm .snapshot .dao .VMSnapshotDao ;
213201
214- // ToDo: check access for list APIs when not ROOT admin
215-
216202public class ServerAdapter extends ManagerBase {
217- private static final String SERVICE_ACCOUNT_NAME = "veemserviceuser" ;
218- private static final String SERVICE_ACCOUNT_ROLE_NAME = "Veeam Service Role" ;
219- private static final String SERVICE_ACCOUNT_FIRST_NAME = "Veeam" ;
220- private static final String SERVICE_ACCOUNT_LAST_NAME = "Service User" ;
221- private static final List <Class <?>> SERVICE_ACCOUNT_ROLE_ALLOWED_APIS = Arrays .asList (
222- QueryAsyncJobResultCmd .class ,
223- ListVMsCmd .class ,
224- DeployVMCmd .class ,
225- StartVMCmd .class ,
226- StopVMCmd .class ,
227- DestroyVMCmd .class ,
228- ListVolumesCmd .class ,
229- CreateVolumeCmd .class ,
230- DeleteVolumeCmd .class ,
231- AttachVolumeCmd .class ,
232- DetachVolumeCmd .class ,
233- ResizeVolumeCmd .class ,
234- ListNetworksCmd .class
235- );
236203 private static final List <Storage .StoragePoolType > SUPPORTED_STORAGE_TYPES = Arrays .asList (
237204 Storage .StoragePoolType .Filesystem ,
238205 Storage .StoragePoolType .NetworkFilesystem ,
@@ -241,9 +208,6 @@ public class ServerAdapter extends ManagerBase {
241208 private static final String VM_TA_KEY = "veeam_tag" ;
242209 private static final String WORKER_VM_GUEST_CPU_MODE = "host-passthrough" ;
243210
244- @ Inject
245- RoleService roleService ;
246-
247211 @ Inject
248212 AccountService accountService ;
249213
@@ -346,74 +310,13 @@ public class ServerAdapter extends ManagerBase {
346310 @ Inject
347311 DomainDao domainDao ;
348312
349- protected static Tag getDummyTagByName (String name ) {
350- Tag tag = new Tag ();
351- String id = UUID .nameUUIDFromBytes (String .format ("veeam:%s" , name .toLowerCase ()).getBytes ()).toString ();
352- tag .setId (id );
353- tag .setName (name );
354- tag .setDescription (String .format ("Default %s tag" , name .toLowerCase ()));
355- tag .setHref (VeeamControlService .ContextPath .value () + TagsRouteHandler .BASE_ROUTE + "/" + id );
356- tag .setParent (ResourceTagVOToTagConverter .getRootTagRef ());
357- return tag ;
358- }
359-
360313 protected static Map <String , Tag > getDummyTags () {
361314 Map <String , Tag > tags = new HashMap <>();
362315 Tag rootTag = ResourceTagVOToTagConverter .getRootTag ();
363316 tags .put (rootTag .getId (), rootTag );
364317 return tags ;
365318 }
366319
367- protected Role createServiceAccountRole () {
368- Role role = roleService .createRole (SERVICE_ACCOUNT_ROLE_NAME , RoleType .User ,
369- SERVICE_ACCOUNT_ROLE_NAME , false );
370- for (Class <?> allowedApi : SERVICE_ACCOUNT_ROLE_ALLOWED_APIS ) {
371- final String apiName = BaseCmd .getCommandNameByClass (allowedApi );
372- roleService .createRolePermission (role , new Rule (apiName ), RolePermissionEntity .Permission .ALLOW ,
373- String .format ("Allow %s" , apiName ));
374- }
375- roleService .createRolePermission (role , new Rule ("*" ), RolePermissionEntity .Permission .DENY ,
376- "Deny all" );
377- logger .debug ("Created default role for Veeam service account in projects: {}" , role );
378- return role ;
379- }
380-
381- protected Role getServiceAccountRole () {
382- List <Role > roles = roleService .findRolesByName (SERVICE_ACCOUNT_ROLE_NAME );
383- if (CollectionUtils .isNotEmpty (roles )) {
384- Role role = roles .get (0 );
385- logger .debug ("Found default role for Veeam service account in projects: {}" , role );
386- return role ;
387- }
388- return createServiceAccountRole ();
389- }
390-
391- protected UserAccount createServiceAccount () {
392- CallContext .register (User .UID_SYSTEM , Account .ACCOUNT_ID_SYSTEM );
393- try {
394- Role role = getServiceAccountRole ();
395- UserAccount userAccount = accountService .createUserAccount (SERVICE_ACCOUNT_NAME ,
396- UUID .randomUUID ().toString (), SERVICE_ACCOUNT_FIRST_NAME ,
397- SERVICE_ACCOUNT_LAST_NAME , null , null , SERVICE_ACCOUNT_NAME , Account .Type .NORMAL , role .getId (),
398- 1L , null , null , null , null , User .Source .NATIVE );
399- logger .debug ("Created Veeam service account: {}" , userAccount );
400- return userAccount ;
401- } finally {
402- CallContext .unregister ();
403- }
404- }
405-
406- protected Pair <User , Account > getDefaultServiceAccount () {
407- UserAccount userAccount = accountService .getActiveUserAccount (SERVICE_ACCOUNT_NAME , 1L );
408- if (userAccount == null ) {
409- userAccount = createServiceAccount ();
410- } else {
411- logger .debug ("Veeam service user account found: {}" , userAccount );
412- }
413- return new Pair <>(accountService .getActiveUser (userAccount .getId ()),
414- accountService .getActiveAccountById (userAccount .getAccountId ()));
415- }
416-
417320 protected void waitForJobCompletion (long jobId ) {
418321 long timeoutNanos = TimeUnit .MINUTES .toNanos (5 );
419322 final long deadline = System .nanoTime () + timeoutNanos ;
0 commit comments