project

func AllowBackupCreation ¶

func AllowBackupCreation(tx *db.ClusterTx, projectName string) error

AllowBackupCreation returns an error if any project-specific restriction is violated when creating a new backup in a project.

func AllowClusterGroup ¶

func AllowClusterGroup(p *api.Project, groupName string) error

AllowClusterGroup returns nil if the given project is allowed to use the cluster groupName.

func AllowClusterMember ¶

func AllowClusterMember(p *api.Project, member *db.NodeInfo) error

AllowClusterMember returns nil if the given project is allowed to use the cluster member.

func AllowImageDownload ¶

func AllowImageDownload(tx *db.ClusterTx, projectName string, uri string) error

AllowImageDownload returns an error if any project-specific restriction is violated when downloading a new image.

func AllowInstanceCreation ¶

func AllowInstanceCreation(tx *db.ClusterTx, projectName string, req api.InstancesPost) error

AllowInstanceCreation returns an error if any project-specific limit or restriction is violated when creating a new instance.

func AllowInstanceMigrationSource ¶ added in v7.5.0

func AllowInstanceMigrationSource(tx *db.ClusterTx, projectName string, req api.InstancesPost) error

AllowInstanceMigrationSource checks that the project restrictions allow the migration source of the request.

func AllowInstanceUpdate ¶

func AllowInstanceUpdate(tx *db.ClusterTx, projectName, instanceName string, req api.InstancePut, currentConfig map[string]string) error

AllowInstanceUpdate returns an error if any project-specific limit or restriction is violated when updating an existing instance.

func AllowProfileCreation ¶ added in v7.5.0

func AllowProfileCreation(tx *db.ClusterTx, projectName string, req api.ProfilesPost) error

AllowProfileCreation checks that project limits and restrictions are not violated when creating a profile.

func AllowProfileUpdate ¶

func AllowProfileUpdate(tx *db.ClusterTx, projectName, profileName string, req api.ProfilePut) error

AllowProfileUpdate checks that project limits and restrictions are not violated when changing a profile.

func AllowProjectUpdate ¶

func AllowProjectUpdate(tx *db.ClusterTx, projectName string, config map[string]string, changed []string) error

AllowProjectUpdate checks the new config to be set on a project is valid.

func AllowSnapshotCreation ¶

func AllowSnapshotCreation(p *api.Project) error

AllowSnapshotCreation returns an error if any project-specific restriction is violated when creating a new snapshot in a project.

func AllowSnapshotRestore ¶ added in v7.5.0

func AllowSnapshotRestore(tx *db.ClusterTx, projectName, instanceName string, req api.InstancePut, currentConfig map[string]string) error

AllowSnapshotRestore checks project limits and restrictions for a snapshot restore, replacing unsafe volatile.* keys in req.Config.

func AllowVolumeConfig ¶ added in v7.5.0

func AllowVolumeConfig(tx *db.ClusterTx, projectName string, poolName string, config map[string]string) error

AllowVolumeConfig returns an error if any project-specific restriction is violated by the effective config of a custom volume being created.

func AllowVolumeCreation ¶

func AllowVolumeCreation(tx *db.ClusterTx, projectName string, poolName string, req api.StorageVolumesPost) error

AllowVolumeCreation returns an error if any project-specific limit or restriction is violated when creating a new custom volume in a project.

func AllowVolumeMove ¶ added in v7.5.0

func AllowVolumeMove(tx *db.ClusterTx, srcProjectName string, srcPoolName string, projectName string, poolName string, vol *api.StorageVolume, newName string) error

AllowVolumeMove returns an error if moving the given custom volume into the target project would violate the project's limits or restrictions.

func AllowVolumeUpdate ¶

func AllowVolumeUpdate(tx *db.ClusterTx, projectName string, poolName string, volumeName string, req api.StorageVolumePut, currentConfig map[string]string) error

AllowVolumeUpdate returns an error if any project-specific limit or restriction is violated when updating an existing custom volume.

func CheckClusterTargetRestriction ¶

func CheckClusterTargetRestriction(authorizer auth.Authorizer, r *http.Request, project *api.Project, targetFlag string) error

CheckClusterTargetRestriction check if user is allowed to use cluster member targeting.

func CheckLimits ¶ added in v7.5.0

func CheckLimits(tx *db.ClusterTx, projectName string) error

CheckLimits returns an error if the project's current instances and volumes exceed its limits. It is meant to run inside the transaction recording a new instance or volume, closing the window between the pre-creation check and the database insert.

func CheckRestrictedDevicesDiskPaths ¶

func CheckRestrictedDevicesDiskPaths(projectConfig map[string]string, sourcePath string) (bool, string)

CheckRestrictedDevicesDiskPaths checks whether the disk's source path is within the allowed paths specified in the project's restricted.devices.disk.paths config setting. If no allowed paths are specified in project, then it allows all paths, and returns true and empty string. If allowed paths are specified, and one matches, returns true and the matching allowed parent source path. Otherwise if sourcePath not allowed returns false and empty string.

func CheckTarget ¶

func CheckTarget(ctx context.Context, authorizer auth.Authorizer, r *http.Request, tx *db.ClusterTx, p *api.Project, target string, allMembers []db.NodeInfo) (*db.NodeInfo, string, error)

CheckTarget checks if the given cluster target (member or group) is allowed. If target is a cluster member and is found in allMembers it returns the resolved node information object. If target is a cluster group it returns the cluster group name. In case of error, neither node information nor cluster group name gets returned.

func CheckTargetGroup ¶

func CheckTargetGroup(ctx context.Context, tx *db.ClusterTx, p *api.Project, groupName string) error

CheckTargetGroup checks if the given groupName is allowed for the project.

func CheckTargetMember ¶

func CheckTargetMember(p *api.Project, targetMemberName string, allMembers []db.NodeInfo) (*db.NodeInfo, error)

CheckTargetMember checks if the given targetMemberName is present in allMembers and is allowed for the project. If the target member is allowed it returns the resolved node information.

func DNS ¶

func DNS(projectName string, instanceName string) string

DNS adds ".<project>" as a suffix to instance name when the given project name is not "default".

func FilterUsedBy ¶

func FilterUsedBy(authorizer auth.Authorizer, r *http.Request, entries []string) []string

FilterUsedBy filters a UsedBy list based on project access.

func GetCurrentAllocations ¶

func GetCurrentAllocations(ctx context.Context, tx *db.ClusterTx, projectName string) (map[string]api.ProjectStateResource, error)

GetCurrentAllocations returns the current resource utilization for a given project.

func GetImageSpaceBudget ¶

func GetImageSpaceBudget(tx *db.ClusterTx, projectName string) (int64, error)

GetImageSpaceBudget returns how much disk space is left in the given project for writing images.

If no limit is in place, return -1.

func GetRestrictedClusterGroups ¶

func GetRestrictedClusterGroups(p *api.Project) []string

GetRestrictedClusterGroups returns a slice of restricted cluster groups for the given project.

func GetSpaceBudget ¶

func GetSpaceBudget(tx *db.ClusterTx, projectName string) (int64, error)

GetSpaceBudget returns how much disk space is left in the given project.

If no limit is in place, return -1.

func HiddenStoragePools ¶

func HiddenStoragePools(ctx context.Context, tx *db.ClusterTx, projectName string, allPoolNames []string) ([]string, error)

HiddenStoragePools returns a list of storage pools that should be hidden from users of the project.

func ImageProjectFromRecord ¶

func ImageProjectFromRecord(p *api.Project) string

ImageProjectFromRecord returns the project name to use for the image based on the supplied project. If the project supplied has the "features.images" flag enabled then the project name is returned, otherwise the default project name is returned.

func Instance ¶

func Instance(projectName string, instanceName string) string

Instance adds the "<project>_" prefix to instance name when the given project name is not "default".

package main

import (
	"fmt"

	"github.com/lxc/incus/v7/internal/server/project"
	"github.com/lxc/incus/v7/shared/api"
)

func main() {
	prefixed := project.Instance(api.ProjectDefaultName, "test")
	fmt.Println(prefixed)

	prefixed = project.Instance("project_name", "test1")
	fmt.Println(prefixed)
}

Output:
test
project_name_test1

func InstanceParts ¶

func InstanceParts(projectInstanceName string) (string, string)

InstanceParts takes a project prefixed Instance name string and returns the project and instance name. If a non-project prefixed Instance name is supplied, then the project is returned as "default" and the instance name is returned unmodified in the 2nd return value. This is suitable for passing back into Instance(). Note: This should only be used with Instance names (because they cannot contain the project separator) and this function relies on this rule as project names can contain the project separator.

package main

import (
	"fmt"

	"github.com/lxc/incus/v7/internal/server/project"
	"github.com/lxc/incus/v7/shared/api"
)

func main() {
	projectName, name := project.InstanceParts("unprefixed")
	fmt.Println(projectName, name)

	projectName, name = project.InstanceParts(project.Instance(api.ProjectDefaultName, "test"))
	fmt.Println(projectName, name)

	projectName, name = project.InstanceParts("project_name_test")
	fmt.Println(projectName, name)

	projectName, name = project.InstanceParts(project.Instance("proj", "test1"))
	fmt.Println(projectName, name)

}

Output:
default unprefixed
default test
project_name test
proj test1

func NetworkAllowed ¶

func NetworkAllowed(reqProjectConfig map[string]string, networkName string, isManaged bool) bool

NetworkAllowed returns whether access is allowed to a particular network based on projectConfig.

func NetworkIntegrationAllowed ¶

func NetworkIntegrationAllowed(reqProjectConfig map[string]string, integrationName string) bool

NetworkIntegrationAllowed returns whether access is allowed for a particular network integration based on projectConfig.

func NetworkProject ¶

func NetworkProject(c *db.Cluster, projectName string) (string, *api.Project, error)

NetworkProject returns the effective project name to use for the network based on the requested project. If the requested project has the "features.networks" flag enabled then the requested project's name is returned, otherwise the default project name is returned. The second return value is always the requested project's info.

func NetworkProjectForName ¶ added in v7.4.0

func NetworkProjectForName(c *db.Cluster, projectName string, networkName string) (string, *api.Project, error)

NetworkProjectForName returns the effective project name to use for the given network based on the requested project. Networks shared from the default project resolve to the default project. The second return value is always the requested project's info.

func NetworkProjectForNameFromRecord ¶ added in v7.4.0

func NetworkProjectForNameFromRecord(p *api.Project, networkName string) string

NetworkProjectForNameFromRecord returns the project name to use for the given network based on the supplied project. Networks shared from the default project resolve to the default project.

func NetworkProjectFromRecord ¶

func NetworkProjectFromRecord(p *api.Project) string

NetworkProjectFromRecord returns the project name to use for the network based on the supplied project. If the project supplied has the "features.networks" flag enabled then the project name is returned, otherwise the default project name is returned.

func NetworkSharedFromDefault ¶ added in v7.4.0

func NetworkSharedFromDefault(p *api.Project, networkName string) bool

NetworkSharedFromDefault returns whether the network is shared into the project from the default project. This only applies to restricted projects with "features.networks" enabled and the network listed in restricted.networks.access.

func NetworkZoneProject ¶

func NetworkZoneProject(c *db.Cluster, projectName string) (string, *api.Project, error)

NetworkZoneProject returns the effective project name to use for network zone based on the requested project. If the requested project has the "features.networks.zones" flag enabled then the requested project's name is returned, otherwise the default project name is returned. The second return value is always the requested project's info.

func NetworkZoneProjectFromRecord ¶

func NetworkZoneProjectFromRecord(p *api.Project) string

NetworkZoneProjectFromRecord returns the project name to use for the network zone based on the supplied project. If the project supplied has the "features.networks.zones" flag enabled then the project name is returned, otherwise the default project name is returned.

func ProfileProject ¶

func ProfileProject(c *db.Cluster, projectName string) (*api.Project, error)

ProfileProject returns the effective project to use for the profile based on the requested project. If the requested project has the "features.profiles" flag enabled then the requested project's info is returned, otherwise the default project's info is returned.

func ProfileProjectFromRecord ¶

func ProfileProjectFromRecord(p *api.Project) string

ProfileProjectFromRecord returns the project name to use for the profile based on the supplied project. If the project supplied has the "features.profiles" flag enabled then the project name is returned, otherwise the default project name is returned.

func StorageBucket ¶

func StorageBucket(projectName string, storageBucketName string) string

StorageBucket adds the "<project>_prefix" to the storage bucket name. Even if the project name is "default".

func StorageBucketProject ¶

func StorageBucketProject(ctx context.Context, c *db.Cluster, projectName string) (string, error)

StorageBucketProject returns the effective project name to use to for the bucket based on the requested project. If the project specified has the "features.storage.buckets" flag enabled then the project name is returned, otherwise the default project name is returned.

func StorageBucketProjectFromRecord ¶

func StorageBucketProjectFromRecord(p *api.Project) string

StorageBucketProjectFromRecord returns the project name to use to for the bucket based on the supplied project. If the project supplied has the "features.storage.buckets" flag enabled then the project name is returned, otherwise the default project name is returned.

func StoragePoolAllowed ¶

func StoragePoolAllowed(reqProjectConfig map[string]string, poolName string) bool

StoragePoolAllowed returns whether access is allowed to a particular storage pool based on project limits and restrictions. A pool is inaccessible if it has an explicit size limit of 0 (limits.disk.pool.POOLNAME=0) or if restricted.storage-pools.access is set and the pool is not in the allowlist (treated as equivalent to a size limit of 0).

func StorageVolume ¶

func StorageVolume(projectName string, storageVolumeName string) string

StorageVolume adds the "<project>_prefix" to the storage volume name. Even if the project name is "default".

package main

import (
	"fmt"

	"github.com/lxc/incus/v7/internal/server/project"
	"github.com/lxc/incus/v7/shared/api"
)

func main() {
	prefixed := project.StorageVolume(api.ProjectDefaultName, "test")
	fmt.Println(prefixed)

	prefixed = project.StorageVolume("project_name", "test1")
	fmt.Println(prefixed)
}

Output:
default_test
project_name_test1

func StorageVolumeParts ¶

func StorageVolumeParts(projectStorageVolumeName string) (string, string)

StorageVolumeParts takes a project prefixed storage volume name and returns the project and storage volume name as separate variables.

func StorageVolumeProject ¶

func StorageVolumeProject(c *db.Cluster, projectName string, volumeType int) (string, error)

StorageVolumeProject returns the project name to use to for the volume based on the requested project. For image volume types the default project is always returned. For custom volume type, if the project specified has the "features.storage.volumes" flag enabled then the project name is returned, otherwise the default project name is returned. For all other volume types the supplied project name is returned.

func StorageVolumeProjectFromRecord ¶

func StorageVolumeProjectFromRecord(p *api.Project, volumeType int) string

StorageVolumeProjectFromRecord returns the project name to use to for the volume based on the supplied project. For image volume types the default project is always returned. For custom volume type, if the project supplied has the "features.storage.volumes" flag enabled then the project name is returned, otherwise the default project name is returned. For all other volume types the supplied project's name is returned.