This patch adds a network plugin to support Palo Alto Networks firewall (their appliance and their VM series firewall).
More information in the FS: https://cwiki.apache.org/confluence/display/CLOUDSTACK/Palo+Alto+Firewall+Integration
Features supported are:
- List/Add/Delete Palo Alto service provider
- List/Add/Delete Palo Alto network service offering
- List/Add/Delete Palo Alto network with above service offering
- Add instance to the new network (creates the public IP and private gateway/cidr on the PA as well as the source nat rule)
- List/Add/Delete Ingress Firewall rule
- List/Add/Delete Egress Firewall rule
- List/Add/Delete Port Forwarding rule
- List/Add/Delete Static Nat rule
- Supports Palo Alto Networks 'Log Forwarding' profile globally per device (additional docs to come)
- Supports Palo Alto Networks 'Security Profile Groups' functionality globally per device (additional docs to come)
Knowns limitations:
- Only supports one public IP range in CloudStack.
- Currently not verifying SSL certificates when creating a connection between CloudStack and the Palo Alto Networks firewall.
- Currently not tracking usage on Public IPs.
Signed-off-by: Sheng Yang <sheng.yang@citrix.com>
TODO:
1. error handling of no domains present, nested hierarchy
2. handling the case when the api call fails for a specific user/users
3. test cases for LdapUserManager
Signed-off-by: Ian Duffy <ian@ianduffy.ie>
UI support for baremetal PXE server
CloudStack CLOUDSTACK-1364
UI support for baremetal DHCP server
Conflicts:
plugins/hypervisors/baremetal/src/com/cloud/baremetal/networkservice/BareMetalPingServiceImpl.java
plugins/hypervisors/baremetal/src/com/cloud/baremetal/networkservice/BaremetalKickStartServiceImpl.java
plugins/hypervisors/baremetal/src/com/cloud/baremetal/networkservice/BaremetalPxeManagerImpl.java
Changes:
- Locking the group and save reservation mechanism done by DPM
- Added admin operation to cleanup VM reservations
- DPM will also cleanup VM reservations on startup
Discovery plugin will detect APIs from pluggable services and map them
to those in commands.properties. Including the latter to complete the
mapping so listApis now returns these APIs.
Also included fix for API docs.
Signed-off-by: Prasanna Santhanam <tsp@apache.org>
This feature allows a user to deploy VMs only in the resources dedicated to his account or domain.
1. Resources(Zones, Pods, Clusters or hosts) can be dedicated to an account or domain.
Implemented 12 new APIs to dedicate/list/release resources:
- dedicateZone, listDedicatedZones, releaseDedicatedZone for a Zone.
- dedicatePod, listDedicatedPods, releaseDedicatedPod for a Pod.
- dedicateCluster, listDedicatedClusters, releaseDedicatedCluster for a Cluster
- dedicateHost, listDedicatedHosts, releaseDedicatedHost for a Host.
2. Once a resource(eg. pod) is dedicated to an account, other resources(eg. clusters/hosts) inside that cannot be further dedicated.
3. Once a resource is dedicated to a domain, other resources inside that can be further dedicated to its sub-domain or account.
4. If any resource (eg.cluster) is dedicated to a account/domain, then resources(eg. Pod) above that cannot be dedicated to different accounts/domain (not belonging to the same domain)
5. To use Explicit dedication, user needs to create an Affinity Group of type 'ExplicitDedication'
6. A VM can be deployed with the above affinity group parameter as an input.
7. A new ExplicitDedicationProcessor has been added which will process the affinity group of type 'Explicit Dedication' for a deployment of a VM that demands dedicated resources.
This processor implements the AffinityGroupProcessor adapter. This processor will update the avoid list.
8. A VM requesting dedication will be deployed on dedicatd resources if available with the user account.
9. A VM requesting dedication can also be deployed on the dedicated resources available with the parent domains iff no dedicated resources are available with the current user's account or
domain.
10. A VM (without dedication) can be deployed on shared host but not on dedicated hosts.
11. To modify the dedication, the resource has to be released first.
12. Existing Private zone functionality has been redirected to Explicit dedication of zones.
13. Updated the db upgrade schema script. A new table "dedicated_resources" has been added.
14. Added the right permissions in commands.properties
15. Unit tests: For the new APIs and Service, added unit tests under : plugins/dedicated-resources/test/org/apache/cloudstack/dedicated/DedicatedApiUnitTest.java
16. Marvin Test: To dedicate host, create affinity group, deploy-vm, check if vm is deployed on the dedicated host.
Squashed commit of the following:
commit f244f9ce7982db16984dd87c31545f1c0240c704
Merge: 993cbb0 f5c8e38
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Mon May 20 18:54:05 2013 +0530
Merge branch 'master' into portablepublicip
Conflicts:
server/src/com/cloud/server/ManagementServerImpl.java
server/test/org/apache/cloudstack/networkoffering/ChildTestConfiguration.java
commit 993cbb0df9fa6e64b96b18ed775b73cdf4a8f5d7
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Mon May 20 18:49:54 2013 +0530
introduce 'transferPortableIP' interface method in network manger. This
method will transfer association of portable ip from one network to
another network.
commit 0c1c2652c1b39e9a81ca35464360e11ed9ef23f1
Merge: a718d35 a29e393
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Fri May 17 02:48:54 2013 +0530
Merge branch 'master' into portablepublicip
Conflicts:
utils/src/com/cloud/utils/net/NetUtils.java
commit a718d353f7acf0328d928673df6f22de1abc0acb
Merge: ecca117 c211818
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Mon May 13 21:22:19 2013 +0530
Merge branch 'master' into portablepublicip
Conflicts:
api/src/org/apache/cloudstack/api/ResponseGenerator.java
server/src/com/cloud/api/ApiResponseHelper.java
server/src/com/cloud/network/NetworkServiceImpl.java
server/src/com/cloud/network/addr/PublicIp.java
server/src/com/cloud/server/ManagementServerImpl.java
server/test/com/cloud/network/MockNetworkManagerImpl.java
server/test/com/cloud/vpc/MockConfigurationManagerImpl.java
server/test/com/cloud/vpc/MockNetworkManagerImpl.java
setup/db/db/schema-410to420.sql
commit ecca117e345224059297f5c1ffa0f442209b3160
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Mon May 13 20:05:29 2013 +0530
added integration tests for testing portable ip ranges
commit 895a27c2771dbb497ecc6fe0d212589f012a48d8
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Mon May 13 15:12:19 2013 +0530
- establish model for transferring portable IP association from a network
with which it is associated to another network.
- enabling static nat api, extended to transfer potrtable IP across the
networks if the VM/network is different from the current associate
network of the portable ip
commit 51509751b290c0e51cbdd104a9aebff189cbe806
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Mon May 13 12:05:33 2013 +0530
seperate out associate/disassociate with guest network operations from
alloc and release of portable ip
commit bd058f58c2d8d36ec25e31ed9de4cd414e0ca051
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Sun May 12 21:14:48 2013 +0530
enhance disasociateIPAddr API to release protable IP associated with a
guest network or VPC
commit 27504d9098729e8c3ac3b33f053f2d66ac2c4401
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Sun May 12 16:53:45 2013 +0530
enhance asociateIPAddr API to acquire a protable IP and associate with a
guest network or VPC
commit f82c6a8431647114462665c1306c6215cb92afd3
Merge: 3dbfb44 0749013
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Sat May 11 23:32:13 2013 +0530
Merge branch 'master' into portablepublicip
Conflicts:
api/src/com/cloud/network/IpAddress.java
api/src/org/apache/cloudstack/api/ResponseGenerator.java
client/tomcatconf/commands.properties.in
server/src/com/cloud/api/ApiResponseHelper.java
server/src/com/cloud/configuration/ConfigurationManagerImpl.java
server/src/com/cloud/server/ManagementServerImpl.java
server/test/org/apache/cloudstack/affinity/AffinityApiTestConfiguration.java
server/test/org/apache/cloudstack/networkoffering/ChildTestConfiguration.java
setup/db/db/schema-410to420.sql
commit 3dbfb44eb5b888367375a96b8ae0ac9cf54309a6
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Sat May 11 20:33:19 2013 +0530
- add 'portable' boolean as property of IpAddress, persist the property in
IPAddressVO, return the property in IpAddressResponse
- add ability to request portable IP in associateIpAddress api
commit bf3cb274cfeb1ef41c63794ced83c7c6940f34cc
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Sat May 11 16:08:40 2013 +0530
add the status of each portable IP (its state, details of associated data
center/VPC/guest network etc) in the PortableIpRangeResponse returned by
listPortableIpRanges API
commit e7b2fb22557cb4ef0ce9c8dde3ed1b9c857038bf
Author: Murali Reddy <muralimmreddy@gmail.com>
Date: Sat May 11 14:36:01 2013 +0530
Introdcues notion of 'portable IP' pool at region level.
Introduces root admin only API's to provision portable ip to a region
- createPortableIpRange
- deletePortableIpRange
- listPortableIpRanges
