Restrict CPU and RAM from templates

Introduction

In Abiquo 3.8.5+, in private cloud datacenters, administrators can edit a virtual machine template to set minimum and maximum values for CPU and RAM for virtual machines created from the template.

If the minimum and maximum values are set to 0 or empty, then there are no constraints. In any case, the allocation limits on enterprises, VDCs, etc. will still apply.

And in Abiquo 3.8.5+, for users to edit CPU and RAM in virtual machines, Abiquo has privileges for three different levels of user access:

No edit access
Edit within range
Override constraints

By default, all users have edit access and the cloud administrator can override constraints.

If the administrator updates the values for minimum and maximum CPU and RAM, then the changes apply to existing VMs that are within range but are not forced on VMs that are out of range.

If the minimum and maximum values are the same, the virtual machine user will not be able to change the value unless they have the Override virtual machine constraints privilege.

Cloud Administrator tasks

The cloud administrator can configure privileges to control editing CPU and RAM.

Task ________________________________________	Notes
Prevent users from editing CPU and RAM in VM	Remove the Edit virtual machine details privilege
By default, users can edit CPU and RAM in VM	The default USER and ENTERPRISE_ADMIN roles have the Edit virtual machine details privilege
Allow users to set out-of-range values for CPU and RAM in VM	Add the Override virtual machine constraints privilege. By default only the CLOUD_ADMIN role has this privilege

Administrator tasks

Task ________________________________________	Notes
Set minimum and maximum values in VM template	Edit a VM template to set these values If 0 or empty, then there is no constraint The platform stores 0 as an empty value, so if you enter "0", it will disappear! Administrators cannot set a minimum below the current template value
Change minimum and maximum values in VM template	Changes apply to new VMs; they are not retroactive If users edit existing VMs that already had out-of-range values, the platform displays a warning but does not enforce the range
Export a template	The platform will validate and export the maximum, default and minimum values
Duplicate a template or promote an instance	The platform will validate and copy the maximum, default and minimum values
Delete a template that is in use, making it unavailable	Administrators cannot edit a template in the unavailable state However, the administrator can assign the Override virtual machine constraints privilege, or edit the VM directly with this privilege

User tasks

Task ________________________________________	Notes
Edit CPU and RAM in virtual machine - with Edit virtual machine details privilege only	You cannot save the VM if you enter values outside the allowed ranges The platform will discard other changes to the VM if you enter CPU and RAM that are out of range The allowed ranges apply to VMs as soon as you create them (even before deploy) Regular allocation limits for VDC, enterprise, etc. will also still apply If the administrator changes the ranges, then the new ranges will apply to your VMs However, if you have VMs that are outside the new range, the changes will not be forced
Make changes to VMs with CPU and/or RAM out of range - with Edit virtual machine details privilege only	If the VM has out-of-range values for CPU and RAM: You can edit other VM attributes and save the VM with the existing values for CPU and RAM You can edit other VM attributes and change the CPU and RAM to values within range
Edit CPU and RAM in virtual machine - with additional Override virtual machine constraints privilege	You can save the virtual machine with values outside the allowed ranges Regular allocation limits for VDC, enterprise, etc. will also still apply You can change values even in virtual machines created from templates that are now unavailable If the administrator changes the ranges, then the new ranges will apply to your VMs However, if you have VMs that are outside the new range, the changes will not be forced
Create an instance	The instance will copy the allowed ranges for CPU and RAM

Example of change to allowed range

This example shows how changes to the allowed range are not forced on VMs that already have values that are outside of the allowed range. A template had a maximum of 4 CPUs, and the user already created a virtual machine with 4 CPUs. Then the administrator edits the templates and changes the maximum CPU value to 2. When the user edits the VM and attempts to change the CPU to 3, the platform will display an error message but it will not change the CPU value, which will still be 4 CPUs.