[Users] Quota for VMs created from templates

[Gilad Chaplik]

Einav, Thanks for the questions, see inline.

> 
> @Gilad:
> 
> 1. Does the 'VmCreator' Role contain the 'consume-quota' action? so when
> granting "VmCreator"
> on Data Center "DC1" to user "User1", "User1" can automatically consume any
> quota defined
> in "DC1" (including, for example, "TemplateQuota", in Mitja's case)?

No, only SuperUser and DataCenterAdmin roles contains consume_quota action.

> 
> 2. Related to both your previous reply and my previous reply: Can a user
> associate a CPU/RAM
> Quota to a VM that he is now *creating*, even if he doesn't have
> consume-quota permissions
> on that CPU/RAM Quota? In Mitja's case, he attempted to create a VM
> associated with both
> "TemplateQuota" and "UserQuota", while the user (maybe - depends on answer to
> 1) didn't
> have permission to consume "TemplateQuota", and the VM creation succeeded. Is
> that OK?

Yes, you should be able to assign a VM to a CPU/RAM quota, without 
being a consumer of that quota, the check is done only when running the VM (when the resources are consumed).

There is a difference between User and Admin Portal: in User portal quota list is being
populated by quota that can be consumed by the user, so leaving the quota unchanged will selected an appropriate
quota; also while creating a VM, disk's quota is set in 'Resource Allocation' tab (see image).

@Mitja, 

Please check which quota(s) are assigned to VM while consuming the resources,
and who is the user performing the task.

> 
> [if the answer to both questions is "no", there is a chance that Mitja
> discovered a bug]
> 
> ----
> Thanks,
> Einav
> 
> 
> ----- Original Message -----
> > From: "Mitja Mihelič" <mitja.mihelic at arnes.si>
> > To: "Einav Cohen" <ecohen at redhat.com>
> > Cc: users at ovirt.org
> > Sent: Friday, October 4, 2013 8:14:10 AM
> > Subject: Re: [Users] Quota for VMs created from templates
> > 
> > In addition to the described setup:
> > The user was also given a permission on the data center with the role
> > VmCreator.
> > The user is not listed as a consumer of TemplateQuota, but they have an
> > inherited role VmCreator in the permissions tab.
> > Could this permission be the reason the user can create and run VMs that
> > are associated with TemplateQuota?
> > 
> > Regards,
> > Mitja
> > 
> > --
> > Mitja Mihelič
> > ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia
> > tel: +386 1 479 8877, fax: +386 1 479 88 78
> > 
> > On 10/03/2013 05:06 PM, Einav Cohen wrote:
> > > AFAIK, a user cannot create a VM that is associated with one (or more)
> > > quota objects on which he doesn't
> > > have consumer permissions.
> > > i.e. if the VM was created successfully by the user, and this VM is
> > > associated with TemplateQuota, and
> > > with the quota that has been created for the user (let's call it
> > > UserQuota), it means that the user has
> > > consumer permissions on both TemplateQuota and UserQuota.
> > > If the user doesn't have permissions on one of these Quota objects - the
> > > fact that the VM has been created
> > > successfully sounds like a bug to me.
> > >
> > > ----
> > > Thanks,
> > > Einav
> > >
> > > ----- Original Message -----
> > >> From: "Mitja Mihelič" <mitja.mihelic at arnes.si>
> > >> To: users at ovirt.org
> > >> Sent: Thursday, October 3, 2013 9:59:06 AM
> > >> Subject: [Users] Quota for VMs created from templates
> > >>
> > >> Hi!
> > >>
> > >> We are running engine version 3.3.0 on CentOS6 and we have come across a
> > >> problem, possibly a bug.
> > >> When a user creates a VM from a template, the template's quota is
> > >> assigned to the VM.
> > >>
> > >> Here is the setup:
> > >> - quota is set to Enforced on the data center
> > >> - quota is created for template purposes (TemplateQuota)
> > >> - a template is created from a sealed VM with TemplateQuota assigned to
> > >> it
> > >> - quota is created for a user, the user is set as its consumer
> > >> - the user creates a VM from the mentioned template and leaves the quota
> > >> unchanged
> > >> - the created VM consumes the user's storage quota but does not consume
> > >> their memory and CPU quota
> > >>
> > >> This way a user can create and run an arbitrary number of VMs as long
> > >> they stay within their storage quota.
> > >> No errors are reported in the logs.
> > >>
> > >> Kind regards,
> > >> Mitja Mihelic
> > >>
> > >> --
> > >> --
> > >> Mitja Mihelič
> > >> ARNES, Tehnološki park 18, p.p. 7, SI-1001 Ljubljana, Slovenia
> > >> tel: +386 1 479 8877, fax: +386 1 479 88 78
> > >>
> > >>
> > >> _______________________________________________
> > >> Users mailing list
> > >> Users at ovirt.org
> > >> http://lists.ovirt.org/mailman/listinfo/users
> > >>
> > 
> > 
> > _______________________________________________
> > Users mailing list
> > Users at ovirt.org
> > http://lists.ovirt.org/mailman/listinfo/users
> >
> 
-------------- next part --------------
A non-text attachment was scrubbed...
Name: diskQuota1.png
Type: image/png
Size: 48965 bytes
Desc: not available
URL: <http://lists.ovirt.org/pipermail/users/attachments/20131006/f6e5a4b7/attachment-0001.png>