Created attachment 597557 [details] engine.log * Create VM under a quota. * Don't assign consumers to VM. * Run VM as a user. * VM runs and consumes quota resources even though the user isn't assigned to the quota.
merged upstream (http://gerrit.ovirt.org/gitweb?p=ovirt-engine.git;a=commit;h=668f37eb2d63d6003902cb0fcde4f52fb86b3704)
not verified. it seems that consumer tab has no effect. we are blocking a user from running a vm because the vm itself is part of the quota and not the user. reproduction: 1. create a quota with no limit 2. create a vm under the quota 3. assign a user to the vm but do not add the user to the consumer tab 4. try to run the vm results -> user will be able to run the vm second reproduction: 1. create a quota with 256M limit 2. create a vm under the quota 3. assign a user to the vm but not to the consumer tab 4. try to run the vm results -> the user will not be able to run the vm this means that the limitation is determined by the vm and not by adding a user to the consumer tab (if it was the consumer tab we should have been blocked on running the vm on both times since user has no quota privileges)
true - sound like you verified everything works correctly. user permission to a quota is a permission to assign the quota to a VM. anyone with a permission for the VM can run it from that quota after it has been assigned.
speaking to gilad, this is the design. moving to verified on si13