refactor: avoid redundant DB calls when checking for root admin account by shwstppr · Pull Request #11390 · apache/cloudstack

shwstppr · 2025-08-04T11:50:24Z

Description

AccountService.isRootAdmin(Long) is currently invoked each time to check if an account or caller is a root admin, leading to repeated DB lookups. In most cases, the Account object is already available and should be used directly. For the caller, the root admin flag is now cached in CallContext to avoid repeated evaluations.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Without change, 80 calls for AccountDaoImpl.findById during deploy VM and it took 4.994s in a local simulator env,

$ time cmk deploy virtualmachine zoneid=50d134ba-8f56-4018-8636-be3d578d6ac1 templateid=11229cef-6ebe-11f0-bb73-9843fa67404e serviceofferingid=50faea90-caa9-4af9-bcab-e82932ad9ade networkids=04cb503a-2625-4ef6-b740-340c46cff471
{
  "virtualmachine": {
    "account": "user",
    "affinitygroup": [],
    "bootmode": "legacy",
    "boottype": "Bios",
    "cpunumber": 1,
    "cpuspeed": 1000,
    "created": "2025-08-05T10:32:04+0530",
    "deleteprotection": false,
    "details": {},
    "displayname": "QA-0fbcfacf-da04-430c-bafc-ed6ce3543a7c",
    "domain": "ROOT",
    "domainid": "53476c17-6ebd-11f0-bb73-9843fa67404e",
    "domainpath": "/",
    "guestosid": "5338fb33-6ebd-11f0-bb73-9843fa67404e",
    "haenable": false,
    "hasannotations": false,
    "hostcontrolstate": "Enabled",
    "hypervisor": "Simulator",
    "id": "0fbcfacf-da04-430c-bafc-ed6ce3543a7c",
    "ipaddress": "10.1.1.251",
    "isdynamicallyscalable": false,
    "jobid": "3c8e02ce-76b3-4d06-b432-241662ab7d95",
    "jobstatus": 0,
    "lastupdated": "2025-08-05T10:32:07+0530",
    "memory": 1024,
    "name": "QA-0fbcfacf-da04-430c-bafc-ed6ce3543a7c",
    "nic": [
      {
        "broadcasturi": "vlan://183",
        "deviceid": "0",
        "extradhcpoption": [],
        "gateway": "10.1.1.1",
        "id": "aabdb509-19d9-419a-b41d-22f6ffd1e2c3",
        "ipaddress": "10.1.1.251",
        "isdefault": true,
        "isolationuri": "vlan://183",
        "macaddress": "02:01:00:d0:00:0c",
        "netmask": "255.255.255.0",
        "networkid": "04cb503a-2625-4ef6-b740-340c46cff471",
        "networkname": "test",
        "secondaryip": [],
        "traffictype": "Guest",
        "type": "Isolated"
      }
    ],
    "osdisplayname": "CentOS 5.6 (64-bit)",
    "ostypeid": "5338fb33-6ebd-11f0-bb73-9843fa67404e",
    "passwordenabled": false,
    "pooltype": "NetworkFilesystem",
    "readonlydetails": "dataDiskController, rootDiskController",
    "receivedbytes": 0,
    "rootdeviceid": 0,
    "rootdevicetype": "ROOT",
    "securitygroup": [],
    "sentbytes": 0,
    "serviceofferingid": "50faea90-caa9-4af9-bcab-e82932ad9ade",
    "serviceofferingname": "Medium Instance",
    "state": "Running",
    "tags": [],
    "templatedisplaytext": "CentOS 5.6 (64-bit) no GUI (Simulator)",
    "templateformat": "VHD",
    "templateid": "11229cef-6ebe-11f0-bb73-9843fa67404e",
    "templatename": "CentOS 5.6 (64-bit) no GUI (Simulator)",
    "templatetype": "BUILTIN",
    "userid": "3fd2a667-690c-407e-a194-9dd7d73bfa2f",
    "username": "user",
    "zoneid": "50d134ba-8f56-4018-8636-be3d578d6ac1",
    "zonename": "zim1"
  }
}

real	0m4.994s
user	0m0.048s
sys	0m0.010s

After the change, AccountDaoImpl.findById calls reduced to 45 during deploy VM, and it took 3.082s in a local simulator env,

$ time cmk deploy virtualmachine zoneid=50d134ba-8f56-4018-8636-be3d578d6ac1 templateid=11229cef-6ebe-11f0-bb73-9843fa67404e serviceofferingid=50faea90-caa9-4af9-bcab-e82932ad9ade networkids=04cb503a-2625-4ef6-b740-340c46cff471
{
  "virtualmachine": {
    "account": "user",
    "affinitygroup": [],
    "bootmode": "legacy",
    "boottype": "Bios",
    "cpunumber": 1,
    "cpuspeed": 1000,
    "created": "2025-08-05T10:46:35+0530",
    "deleteprotection": false,
    "details": {},
    "displayname": "QA-dee76859-8dcf-4f40-8881-13b1f768757a",
    "domain": "ROOT",
    "domainid": "53476c17-6ebd-11f0-bb73-9843fa67404e",
    "domainpath": "/",
    "guestosid": "5338fb33-6ebd-11f0-bb73-9843fa67404e",
    "haenable": false,
    "hasannotations": false,
    "hostcontrolstate": "Enabled",
    "hypervisor": "Simulator",
    "id": "dee76859-8dcf-4f40-8881-13b1f768757a",
    "ipaddress": "10.1.1.86",
    "isdynamicallyscalable": false,
    "jobid": "f6baf9b7-2b2d-410e-8d74-f887e835c7a4",
    "jobstatus": 0,
    "lastupdated": "2025-08-05T10:46:36+0530",
    "memory": 1024,
    "name": "QA-dee76859-8dcf-4f40-8881-13b1f768757a",
    "nic": [
      {
        "broadcasturi": "vlan://183",
        "deviceid": "0",
        "extradhcpoption": [],
        "gateway": "10.1.1.1",
        "id": "2bc5439c-ca23-4c5d-9ddd-9e63c9f45c01",
        "ipaddress": "10.1.1.86",
        "isdefault": true,
        "isolationuri": "vlan://183",
        "macaddress": "02:01:00:d0:00:0d",
        "netmask": "255.255.255.0",
        "networkid": "04cb503a-2625-4ef6-b740-340c46cff471",
        "networkname": "test",
        "secondaryip": [],
        "traffictype": "Guest",
        "type": "Isolated"
      }
    ],
    "osdisplayname": "CentOS 5.6 (64-bit)",
    "ostypeid": "5338fb33-6ebd-11f0-bb73-9843fa67404e",
    "passwordenabled": false,
    "pooltype": "NetworkFilesystem",
    "readonlydetails": "dataDiskController, rootDiskController",
    "receivedbytes": 0,
    "rootdeviceid": 0,
    "rootdevicetype": "ROOT",
    "securitygroup": [],
    "sentbytes": 0,
    "serviceofferingid": "50faea90-caa9-4af9-bcab-e82932ad9ade",
    "serviceofferingname": "Medium Instance",
    "state": "Running",
    "tags": [],
    "templatedisplaytext": "CentOS 5.6 (64-bit) no GUI (Simulator)",
    "templateformat": "VHD",
    "templateid": "11229cef-6ebe-11f0-bb73-9843fa67404e",
    "templatename": "CentOS 5.6 (64-bit) no GUI (Simulator)",
    "templatetype": "BUILTIN",
    "userid": "3fd2a667-690c-407e-a194-9dd7d73bfa2f",
    "username": "user",
    "zoneid": "50d134ba-8f56-4018-8636-be3d578d6ac1",
    "zonename": "zim1"
  }
}

real	0m3.082s
user	0m0.067s
sys	0m0.012s

The considerable time difference (0m4.994s vs 0m3.082s) could be intermittent and may need more testing/profiling. Reduction in DB queries is certainly real.

How did you try to break this feature and the system with this change?

AccountService.isRootAdmin(Long) is currently invoked each time to check if an account or caller is a root admin, leading to repeated DB lookups. In most cases, the Account object is already available and should be used directly. For the caller, the root admin flag is now cached in CallContext to avoid repeated evaluations. Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

codecov · 2025-08-04T12:04:20Z

Codecov Report

❌ Patch coverage is 20.95238% with 166 lines in your changes missing coverage. Please review.
✅ Project coverage is 17.89%. Comparing base (a38205e) to head (7a96d5e).
⚠️ Report is 1 commits behind head on main.

Files with missing lines	Patch %	Lines
...src/main/java/com/cloud/api/ApiResponseHelper.java	6.66%	14 Missing ⚠️
...ain/java/com/cloud/api/query/QueryManagerImpl.java	9.09%	9 Missing and 1 partial ⚠️
...ain/java/com/cloud/network/NetworkServiceImpl.java	9.09%	7 Missing and 3 partials ⚠️
...n/java/com/cloud/storage/VolumeApiServiceImpl.java	0.00%	8 Missing and 1 partial ⚠️
...c/main/java/com/cloud/user/AccountManagerImpl.java	57.14%	5 Missing and 4 partials ⚠️
.../src/main/java/com/cloud/vm/UserVmManagerImpl.java	10.00%	8 Missing and 1 partial ⚠️
...ver/src/main/java/com/cloud/acl/DomainChecker.java	11.11%	8 Missing ⚠️
...n/java/com/cloud/template/TemplateManagerImpl.java	0.00%	7 Missing ⚠️
server/src/main/java/com/cloud/api/ApiServer.java	0.00%	5 Missing ⚠️
...ain/java/com/cloud/storage/StorageManagerImpl.java	28.57%	4 Missing and 1 partial ⚠️
... and 50 more

Additional details and impacted files

@@             Coverage Diff              @@
##              main   #11390       +/-   ##
============================================
+ Coverage     3.67%   17.89%   +14.22%     
- Complexity       0    16088    +16088     
============================================
  Files          452     5936     +5484     
  Lines        38379   532589   +494210     
  Branches      7100    65146    +58046     
============================================
+ Hits          1410    95310    +93900     
- Misses       36783   426613   +389830     
- Partials       186    10666    +10480

Flag	Coverage Δ
uitests	`3.67% <ø> (ø)`
unittests	`19.00% <20.95%> (?)`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

shwstppr · 2025-08-04T18:11:16Z

@blueorangutan package

blueorangutan · 2025-08-04T18:12:04Z

@shwstppr a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-08-04T19:25:35Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14546

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

shwstppr · 2025-08-05T05:23:58Z

@blueorangutan package

blueorangutan · 2025-08-05T05:26:04Z

@shwstppr a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-08-05T06:52:08Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14552

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

shwstppr · 2025-08-05T13:37:45Z

@blueorangutan package

blueorangutan · 2025-08-05T13:40:05Z

@shwstppr a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-08-05T15:16:02Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 14558

shwstppr · 2025-08-05T19:44:13Z

@blueorangutan test

blueorangutan · 2025-08-05T19:46:04Z

@shwstppr a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-08-06T09:45:10Z

[SF] Trillian test result (tid-14035)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 47650 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr11390-t14035-kvm-ol8.zip
Smoke tests completed. 146 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull request overview

Copilot reviewed 82 out of 82 changed files in this pull request and generated 2 comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2025-11-28T10:32:16Z

api/src/main/java/org/apache/cloudstack/context/CallContext.java

+    public boolean isCallingAccountRootAdmin() {
+        if (isAccountRootAdmin == null) {
+            AccountService accountService;
+            try {
+                accountService = ComponentContext.getDelegateComponentOfType(AccountService.class);
+            } catch (NoSuchBeanDefinitionException e) {
+                LOGGER.warn("Falling back to account type check for isRootAdmin for account ID: {} as no AccountService bean found: {}", accountId, e.getMessage());
+                Account caller = getCallingAccount();
+                return caller != null && caller.getType() == Account.Type.ADMIN;
+            }
+            isAccountRootAdmin = accountService.isRootAdmin(getCallingAccount());
+        }
+        return Boolean.TRUE.equals(isAccountRootAdmin);
+    }


The fallback logic at line 149 returns the result directly without caching it in isAccountRootAdmin. This means if AccountService is unavailable, subsequent calls will repeat the check instead of using the cached value. Either cache the result before returning, or document this as intentional behavior.

Copilot · 2025-11-28T10:32:17Z

api/src/main/java/org/apache/cloudstack/context/CallContext.java

+                LOGGER.warn("Falling back to account type check for isRootAdmin for account ID: {} as no AccountService bean found: {}", accountId, e.getMessage());
+                Account caller = getCallingAccount();
+                return caller != null && caller.getType() == Account.Type.ADMIN;


The fallback check caller.getType() == Account.Type.ADMIN is inconsistent with the actual root admin check performed by AccountService, which uses security checkers. This could lead to different behavior when AccountService is unavailable. Consider removing the fallback entirely or throwing an exception to fail fast when AccountService is not available.

Suggested change

LOGGER.warn("Falling back to account type check for isRootAdmin for account ID: {} as no AccountService bean found: {}", accountId, e.getMessage());

Account caller = getCallingAccount();

return caller != null && caller.getType() == Account.Type.ADMIN;

throw new CloudRuntimeException("AccountService bean not found, cannot determine if calling account is root admin for account ID: " + accountId, e);

github-actions · 2025-12-22T13:28:23Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

github-actions · 2026-01-19T13:07:18Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

github-actions · 2026-01-29T10:29:41Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

github-actions · 2026-01-30T08:31:14Z

This pull request has merge conflicts. Dear author, please fix the conflicts and sync your branch with the base branch.

shwstppr · 2026-01-30T10:33:13Z

@blueorangutan package

blueorangutan · 2026-01-30T10:34:05Z

@shwstppr a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

DaanHoogland · 2026-01-30T10:46:04Z

@shwstppr should we backport this to 4.20?

blueorangutan · 2026-01-30T11:23:39Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16650

shwstppr · 2026-01-31T04:45:07Z

@shwstppr should we backport this to 4.20?

@DaanHoogland we can base it for 4.20 as it would also prevent future forward merge conflicts. But I was a bit concerned about breaking something. I'll check and run some tests. I guess it would need more diligent testing if it goes into 4.20.3

abh1sar · 2026-02-01T12:11:13Z

@shwstppr should we backport this to 4.20?

@DaanHoogland we can base it for 4.20 as it would also prevent future forward merge conflicts. But I was a bit concerned about breaking something. I'll check and run some tests. I guess it would need more diligent testing if it goes into 4.20.3

Ya, I am a bit apprehensive about merging this to 4.20.3 late in the release cycle.

DaanHoogland · 2026-02-01T14:52:11Z

@shwstppr should we backport this to 4.20?

@DaanHoogland we can base it for 4.20 as it would also prevent future forward merge conflicts. But I was a bit concerned about breaking something. I'll check and run some tests. I guess it would need more diligent testing if it goes into 4.20.3

Ya, I am a bit apprehensive about merging this to 4.20.3 late in the release cycle.

I understand @Abhisar , But then I would like to mark it for 20.4 . This should really go in as old a release as possible

boring-cyborg bot added component:api component:kubernetes component:networking component:projects labels Aug 4, 2025

Merge remote-tracking branch 'apache/main' into refactor-isrootadmin

61dbcca

shwstppr closed this Aug 4, 2025

shwstppr reopened this Aug 4, 2025

Merge remote-tracking branch 'apache/main' into refactor-isrootadmin

9ff1440

apache deleted a comment from blueorangutan Aug 4, 2025

fix noredist

9ec24e3

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

shwstppr added 2 commits August 5, 2025 10:06

fix no bean error

3be274c

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

build fix

e14ffd4

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

shwstppr added 3 commits August 5, 2025 14:53

fix and changes

b2d4fb6

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

add tests

ef5cf76

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

more test

ffddb7f

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

Copilot finished reviewing on behalf of shwstppr November 28, 2025 06:16

Copilot AI reviewed Nov 28, 2025

View reviewed changes

DaanHoogland requested a review from Copilot November 28, 2025 10:21

Copilot started reviewing on behalf of DaanHoogland November 28, 2025 10:22 View session

Copilot finished reviewing on behalf of DaanHoogland November 28, 2025 10:23

Copilot AI reviewed Nov 28, 2025

View reviewed changes

github-actions bot added the status:has-conflicts label Dec 22, 2025

Merge branch 'main' into refactor-isrootadmin

72909dd

github-actions bot removed the status:has-conflicts label Dec 22, 2025

shwstppr added this to the 4.23.0 milestone Jan 7, 2026

github-actions bot added the status:has-conflicts label Jan 19, 2026

Merge remote-tracking branch 'apache/main' into refactor-isrootadmin

1e173fd

github-actions bot removed the status:has-conflicts label Jan 20, 2026

github-actions bot added the status:has-conflicts label Jan 29, 2026

Merge remote-tracking branch 'apache/main' into refactor-isrootadmin

d2951e6

Signed-off-by: Abhishek Kumar <abhishek.mrt22@gmail.com>

github-actions bot added status:has-conflicts and removed status:has-conflicts labels Jan 29, 2026

Merge branch 'main' into refactor-isrootadmin

7a96d5e

github-actions bot removed the status:has-conflicts label Jan 30, 2026

Conversation

shwstppr commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

The considerable time difference (0m4.994s vs 0m3.082s) could be intermittent and may need more testing/profiling. Reduction in DB queries is certainly real.

How did you try to break this feature and the system with this change?

Uh oh!

codecov bot commented Aug 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

shwstppr commented Aug 4, 2025

Uh oh!

blueorangutan commented Aug 4, 2025

Uh oh!

blueorangutan commented Aug 4, 2025

Uh oh!

shwstppr commented Aug 5, 2025

Uh oh!

blueorangutan commented Aug 5, 2025

Uh oh!

blueorangutan commented Aug 5, 2025

Uh oh!

shwstppr commented Aug 5, 2025

Uh oh!

blueorangutan commented Aug 5, 2025

Uh oh!

blueorangutan commented Aug 5, 2025

Uh oh!

shwstppr commented Aug 5, 2025

Uh oh!

blueorangutan commented Aug 5, 2025

Uh oh!

blueorangutan commented Aug 6, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Nov 28, 2025

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Dec 22, 2025

Uh oh!

github-actions bot commented Jan 19, 2026

Uh oh!

github-actions bot commented Jan 29, 2026

Uh oh!

github-actions bot commented Jan 30, 2026

Uh oh!

shwstppr commented Jan 30, 2026

Uh oh!

blueorangutan commented Jan 30, 2026

Uh oh!

DaanHoogland commented Jan 30, 2026

Uh oh!

blueorangutan commented Jan 30, 2026

Uh oh!

shwstppr commented Jan 31, 2026

Uh oh!

abh1sar commented Feb 1, 2026

Uh oh!

DaanHoogland commented Feb 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

shwstppr commented Aug 4, 2025 •

edited

Loading

codecov bot commented Aug 4, 2025 •

edited

Loading