Avi GSLB services pool member fails to deactivate and enable via the controller GUI
Article ID: 445579
Updated On:
Products
Issue/Introduction
In some use-cases, you may only want to provide granular permissions to limit the access of GSLB service configurations for application users.
For example, you may only want the application user to have access to deactivate and enable GSLB pool member without access to making any configuration changes to the GSLB service.
TechDoc: Granular Role-Based Access Controls Per Field
Example GSLB sub-resource premissions to only disable/enable gslb service pool member:
| privileges[4] | |
| type | WRITE_ACCESS |
| resource | PERMISSION_GSLBSERVICE |
| subresource | |
| exclude_subresources | False |
| subresources[1] | SUBRESOURCE_GSLBSERVICE_GROUP_ENABLED |
| subresources[2] | SUBRESOURCE_GSLBSERVICE_GROUP_MEMBER_ENABLED |In the GSLB service you can select the GSLB pool member and you wil be presented with an options to deactivate or enable.
However, intermittently this operation via the GUI will fail and the status of the GSLB service pool member will not change/update.
In the GSL:B service events you will find the 'CONFIG_UPDATE' event for the GSLB service fail with the following reason(s)/error(s):
User with subresource access does not have permission to create/modify the following fields: {'groups.members.ip.addr'}User with subresource access does not have permission to create/modify the following fields: {'groups.members.ip.addr','domain_names'}This event error fill be followed by or preceding a 'CONFIG_UPDATE' to the same GSLB service made by the 'avisystemuser' user.
The configuration update made by the 'avisystemuser' is part of the DNS resolution/refresh that occurs every 60 minutes per the 'dns_refresh_period' in the controller properties. This DNS refresh is also performed on GSLB service pool members added as FDNS/Domains.
TechDoc: Add Servers to Pool by DNS
Environment
Affects Version(s):
22.1.7-2p11 and older Avi versions.
Cause
There is an issue with AngularJS on 22.1.x version(s) GUI where the _last_modified field is incorrectly sent on all disable/enable PUT Body requests to the GSLB service object. This AngularJS behavior causes a concurrent update conflict with the 'avisystemuser' on the backend of the controller resulting in the GUI error and failure to disable/enable the GSLB pool member(s).
Resolution
This issue with AngularJS on the Avi Controller GUI is fixed on 30.2.x, 31.x, 32.x versions.
As a workaround, the sub-resource permission 'SUBRESOURCE_GSLBSERVICE_GROUP_MEMBERS' can be added to the User role GSLB Service permissions.
Example workaround permissions configuration on 22.1.x:
| privileges[50] | |
| type | WRITE_ACCESS |
| resource | PERMISSION_GSLBSERVICE |
| subresource | |
| exclude_subresources | False |
| subresources[1] | SUBRESOURCE_GSLBSERVICE_GROUP_MEMBER_ENABLED |
| subresources[2] | SUBRESOURCE_GSLBSERVICE_GROUP_ENABLED |
| subresources[3] | SUBRESOURCE_GSLBSERVICE_GROUP_MEMBERS |Feedback
