Scheduled snapshots only visible to self-service user when they're an admin *

[duxepu]

Hi,

it seems to me that the only way a self-service user can interact with snapshots that were created via backup schedule is if I make that user an admin. Is that intended behavior, am I missing something obvious?

• Using xo-server 5.74.1 with xo-web 5.77.0
• Self-service resource set
  • Has sufficient CPU, RAM, storage capacity
  • Has access to pool, host, SR, network where snaps are happening
  • Is managed by group of which affected user is a member
• User has role user
• ACLs include
  • Admin rights on VM
  • Operator rights on pool, hypervisor, SR

The user can take snapshots manually on their VM perfectly fine, they are then able to see these snapshots and interact with them, also delete them. They can, however, not see snapshots taken per schedule unless I change their role to admin.

Is there any way around that?

Thanks!

[olivierlambert]

Question for @pdonias

[pdonias]

Hi @duxepu, no it's not intended. A Self Service user should be able to interact with all the VM's snapshots. Even delete them for now (we'll change that in the future for snapshots they didn't create themselves).
What type of backup is it? Has the user been added to the Self Service before or after the backup was run?

[duxepu]

The snapshot job is of type Rolling Snapshot:

• No advanced settings
• VMs to backup
  • All statuses
  • In our pool
  • One tag selected
  • 5 VMs total are governed by this job
• Schedule
  • 0 4 * * *
  • 9 snapshots retention
  • Enabled

The user existed well before we started doing scheduled snapshots. I just created a new user, made them a member of our problematic user group and am seeing the same behavior as with original group members: snapshots via schedule are not visible unless I change a user's role to admin.

Just to be on the absolute safe side though I did create a new backup schedule after creating my test user to check if order matters. Same result as before. Only difference in job config was that I chose a VM based on name instead of tag. Cron pattern was 27,28,29,30 18 * * * with 2 snapshots retention to get quick results. Snapshot were then visible for an admin but not for a user in the group that runs our resource pool.

What's also interesting is that the user sees a snapshot count on affected VMs' Snapshots tab, the count being absolutely correct with 9 scheduled snapshots and one manual:

I'm not quite sure where the 10th snapshot came from. It's only visible to admin users. I already verified at the beginning that resource pool users can create their own snapshots perfectly fine and interact with them after creation. Since the 10th snapshot here is not visible I'm guessing it was created by means other than the backup schedule or a user in the resource pool. I created yet another snapshot with my own admin account just now that confirmed the theory: to a resource pool user my admin-created snapshot was counted but not visible.

Just for fun I temporarily increased resource pool limits to see if those were affecting the situation. Looks like they weren't, behavior was unchanged.

[pdonias]

@duxepu Ok, this is weird, I'm not able to reproduce that and I don't see how it's possible. Could you check a few things?

• from an admin point of view, at the bottom of the VM's advanced tab, please check that the user has Admin ACLs on the VM
• from the user's point of view, when you're on the snapshots tab, open the browser console (press F12 > Console tab) and check if there are any errors
• do you have this issue with all the users of all your Self Service groups or is it more specific?

Thanks!