Closed (fixed)
Project:
Cloud
Version:
8.x-2.x-dev
Component:
Code
Priority:
Normal
Category:
Feature request
Assigned:
Reporter:
Created:
3 Jun 2020 at 08:22 UTC
Updated:
25 Jun 2020 at 08:54 UTC
Jump to comment: Most recent, Most recent file
Comments
Comment #2
yasComment #3
baldwinlouie commented@yas, I reviewed the patch, and while it looks good and works great for adding the same region multiple times in the system, I have two concerns.
1. Keeping the region in sync. For example, if I have two us-west-2 regions of the same account id (Region A and Region B) defined in the system, and I perform a shutdown or terminate to an instance in Region A. Region A will show the instance as shutdown/terminated. In Region B, the same instance will keep whatever state it has because that region hasn't been updated. This might cause some confusion if the user does not know the system won't update both regions.
2. I grepped the codebase and found that some of the queries do not use the
cloud_contextin them. This *might* cause some issues because the entities might be in different states because of point #1 above.Here are the files and its details
Files that contains
loadByPropertieswhere cloud_context isn't passed into the query.For example, in ElasticIpAssociateForm.php
The following files contains queries using
->getQuery()where cloud_context isn't passed into the query.For example, in aws_cloud.module
Let me know if these fixes should be part of this patch, or another ticket?
Comment #4
baldwinlouie commented@yas As we talked about yesterday, I think the refactoring can happen in another issue ticket. The patch here works as expected and will suffice for the use case we talked about.
Comment #5
yas@baldwinlouie
As we talked, could you please review the patch? I added the validation
aws_cloud_form_cloud_config_aws_cloud_describe_instances_validatewhich validates if a user tries to create an AWS Cloud service provider for the existing region with the credentials that have EC2describeIntancespermission or not. In this way,If yes, the user cannot create the AWS Cloud service provider since we don't allow a user to create an AWS Cloud service provider in the same region in our current implementation.
If no, we may assume that the user tries to create an AWS Cloud service provider with the credentials that doesn't have the
describeInstancepermission, which means the credentials have the permissions other than EC2-related APIs.More precisely, we should validate if the credentials include all API permissions that can be used in
Ec2Service, but I assume it is enough to check onlydescribeInstancesat this point.Comment #6
baldwinlouie commented@yas, Thank you for the patch. It looks good to me. I do have two comments below. Let me know what you think.
I think we should have a bit more documentation regarding why we are doing this validation.
We talked about this over Slack, and it still took me a few times reading the code to understand why we are doing this.
Maybe in another ticket, this is a use case where we should add a way to call the EC2 Service without having the write the ini_file first.
That way, we don't have to manage writing/deleting the ini_file.
Perhaps another issue to do that refactoring?
Comment #7
yas@baldwinlouie
Thank you for your review. I elaborated the
PHPDocheader comment. Could you please review the patch again?As for 2., I think we should address it in another ticket. I agree to your idea.
Comment #8
yasComment #9
baldwinlouie commented@yas, Thank you for the detailed explanation. This looks good to me.
Comment #10
yas@baldwinlouie
Thank you for your review. I'll merge the patch to
8.x-1.xand8.x-2.xand close this issue asFixed.Comment #13
yasComment #14
yasComment #15
yasComment #18
yas