Merge pull request #7227 from ioito/automated-cherry-pick-of-#7224-upstream-release-3.2

Automated cherry pick of #7224: fix: 过滤可用eip
Merge pull request #7223 from ioito/automated-cherry-pick-of-#7221-upstream-release-3.2
2026-09-21 00:24:07 +08:00 · 2020-07-17 20:25:04 +08:00 · 2020-07-17 20:24:05 +08:00 · 2020-07-17 20:16:54 +08:00 · 2020-07-17 18:53:20 +08:00 · 2020-07-17 10:16:43 +08:00
209 changed files with 3974 additions and 1589 deletions
--- a/build/docker/Dockerfile.ansibleserver
+++ b/build/docker/Dockerfile.ansibleserver
@@ -1,3 +1,3 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/ansibleserver-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/ansibleserver-base:1.0.0

-ADD ./_output/bin/ansibleserver /opt/yunion/bin/ansibleserver
+ADD ./_output/alpine-build/bin/ansibleserver /opt/yunion/bin/ansibleserver
--- a/build/docker/Dockerfile.ansibleserver-base
+++ b/build/docker/Dockerfile.ansibleserver-base
@@ -1,13 +1,11 @@
-FROM frolvlad/alpine-glibc:glibc-2.28
+FROM alpine:3.11.6

-MAINTAINER "Zexi Li <lizexi@yunionyun.com>"
+MAINTAINER "Yousong Zhou <zhouyousong@yunionyun.com>"

-ENV TZ Asia/Shanghai
-
-RUN mkdir -p /opt/yunion/bin
-
-RUN apk update && \
-    apk add --no-cache tzdata ansible ca-certificates && \
-    rm -rf /var/cache/apk/*
-
-RUN cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
+# openssh-client, for ansible ssh connection
+RUN set -x \
+	&& apk update \
+	&& apk add openssh-client \
+	&& apk add ansible \
+	&& apk add tzdata ca-certificates \
+	&& rm -rf /var/cache/apk/*
--- a/build/docker/Dockerfile.apigateway
+++ b/build/docker/Dockerfile.apigateway
@@ -1,3 +1,3 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/apigateway /opt/yunion/bin/apigateway
--- a/build/docker/Dockerfile.cloudevent
+++ b/build/docker/Dockerfile.cloudevent
@@ -1,3 +1,3 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/cloudevent /opt/yunion/bin/cloudevent
--- a/build/docker/Dockerfile.cloudnet
+++ b/build/docker/Dockerfile.cloudnet
@@ -1,3 +1,3 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/cloudnet /opt/yunion/bin/cloudnet
--- a/build/docker/Dockerfile.devtool
+++ b/build/docker/Dockerfile.devtool
@@ -1,3 +1,3 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/devtool /opt/yunion/bin/devtool
--- a/build/docker/Dockerfile.esxi-agent
+++ b/build/docker/Dockerfile.esxi-agent
@@ -1,4 +1,4 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 COPY ./build/esxi-agent/root/opt/ /opt/
 ADD ./_output/bin/esxi-agent /opt/yunion/bin/esxi-agent
--- a/build/docker/Dockerfile.keystone
+++ b/build/docker/Dockerfile.keystone
@@ -1,3 +1,3 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/keystone /opt/yunion/bin/keystone
--- a/build/docker/Dockerfile.logger
+++ b/build/docker/Dockerfile.logger
@@ -1,4 +1,4 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/logger /opt/yunion/bin/logger

--- a/build/docker/Dockerfile.monitor
+++ b/build/docker/Dockerfile.monitor
@@ -1,4 +1,4 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/monitor /opt/yunion/bin/monitor

--- a/build/docker/Dockerfile.notify
+++ b/build/docker/Dockerfile.notify
@@ -1,4 +1,4 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 COPY ./build/notify/root/opt/ /opt/
 ADD ./_output/bin/notify /opt/yunion/bin/notify
--- a/build/docker/Dockerfile.onecloud-base
+++ b/build/docker/Dockerfile.onecloud-base
@@ -7,7 +7,7 @@ ENV TZ Asia/Shanghai
 RUN mkdir -p /opt/yunion/bin

 RUN apk update && \
-    apk add --no-cache tzdata ca-certificates && \
+    apk add --no-cache tzdata curl busybox-extras tcpdump strace ca-certificates && \
    rm -rf /var/cache/apk/*

 RUN cp /usr/share/zoneinfo/Asia/Shanghai /etc/localtime
--- a/build/docker/Dockerfile.region
+++ b/build/docker/Dockerfile.region
@@ -1,4 +1,4 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 COPY ./build/region/root/opt/ /opt/
 ADD ./_output/bin/region /opt/yunion/bin/region
--- a/build/docker/Dockerfile.s3gateway
+++ b/build/docker/Dockerfile.s3gateway
@@ -1,3 +1,3 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/s3gateway /opt/yunion/bin/s3gateway
--- a/build/docker/Dockerfile.scheduler
+++ b/build/docker/Dockerfile.scheduler
@@ -1,3 +1,3 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/scheduler /opt/yunion/bin/scheduler
--- a/build/docker/Dockerfile.yunionconf
+++ b/build/docker/Dockerfile.yunionconf
@@ -1,4 +1,4 @@
-FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:latest
+FROM registry.cn-beijing.aliyuncs.com/yunionio/onecloud-base:v0.1

 ADD ./_output/bin/yunionconf /opt/yunion/bin/yunionconf

--- a/cmd/climc/shell/identityproviders.go
+++ b/cmd/climc/shell/identityproviders.go
@@ -299,7 +299,9 @@ func init() {
 		IDP string `help:"identity provider name or ID"`
 	}
 	R(&IdentityProviderConfigEditOptions{}, "idp-config-edit", "Edit config yaml of an identity provider", func(s *mcclient.ClientSession, args *IdentityProviderConfigEditOptions) error {
-		conf, err := modules.IdentityProviders.GetSpecific(s, args.IDP, "config", nil)
+		params := jsonutils.NewDict()
+		params.Add(jsonutils.JSONTrue, "sensitive")
+		conf, err := modules.IdentityProviders.GetSpecific(s, args.IDP, "config", params)
 		if err != nil {
 			return err
 		}
--- a/cmd/climc/shell/secgrouprules.go
+++ b/cmd/climc/shell/secgrouprules.go
@@ -25,33 +25,20 @@ import (
 func init() {
 	type SecGroupRulesListOptions struct {
 		options.BaseListOptions
-		Secgroup  string `help:"Secgroup ID or Name"`
-		Direction string `help:"filter Direction of rule" choices:"in|out"`
-		Protocol  string `help:"filter Protocol of rule" choices:"any|tcp|udp|icmp"`
-		Action    string `help:"filter Actin of rule" choices:"allow|deny"`
+		Secgroup     string `help:"Secgroup ID or Name"`
+		SecgroupName string `help:"Search rules by fuzzy secgroup name"`
+		Project      string `help:"Filter rules by project"`
+		Direction    string `help:"filter Direction of rule" choices:"in|out"`
+		Protocol     string `help:"filter Protocol of rule" choices:"any|tcp|udp|icmp"`
+		Action       string `help:"filter Actin of rule" choices:"allow|deny"`
+		Ports        string `help:"filter Ports of rule"`
+		Ip           string `help:"filter cidr of rule"`
 	}

 	R(&SecGroupRulesListOptions{}, "secgroup-rule-list", "List all security group", func(s *mcclient.ClientSession, args *SecGroupRulesListOptions) error {
-		var params *jsonutils.JSONDict
-		{
-			var err error
-			params, err = args.BaseListOptions.Params()
-			if err != nil {
-				return err
-
-			}
-		}
-		if len(args.Secgroup) > 0 {
-			params.Add(jsonutils.NewString(args.Secgroup), "secgroup")
-		}
-		if len(args.Direction) > 0 {
-			params.Add(jsonutils.NewString(args.Direction), "direction")
-		}
-		if len(args.Protocol) > 0 {
-			params.Add(jsonutils.NewString(args.Protocol), "protocol")
-		}
-		if len(args.Action) > 0 {
-			params.Add(jsonutils.NewString(args.Action), "action")
+		params, err := options.ListStructToParams(args)
+		if err != nil {
+			return err
 		}
 		result, err := modules.SecGroupRules.List(s, params)
 		if err != nil {
--- a/cmd/climc/shell/secgroups.go
+++ b/cmd/climc/shell/secgroups.go
@@ -29,23 +29,15 @@ func init() {
 		Equals string `help:"Secgroup ID or Name, filter secgroups whose rules equals the specified one"`
 		Server string `help:"Filter secgroups bound to specified server"`
 		options.BaseListOptions
+		Ip        string `help:"Filter secgroup by ip"`
+		Ports     string `help:"Filter secgroup by ports"`
+		Direction string `help:"Filter secgroup by ports" choices:"all|in|out"`
 	}

 	R(&SecGroupsListOptions{}, "secgroup-list", "List all security group", func(s *mcclient.ClientSession, args *SecGroupsListOptions) error {
-		var params *jsonutils.JSONDict
-		{
-			var err error
-			params, err = args.BaseListOptions.Params()
-			if err != nil {
-				return err
-
-			}
-		}
-		if len(args.Equals) > 0 {
-			params.Add(jsonutils.NewString(args.Equals), "equals")
-		}
-		if len(args.Server) > 0 {
-			params.Add(jsonutils.NewString(args.Server), "server")
+		params, err := options.ListStructToParams(args)
+		if err != nil {
+			return err
 		}
 		result, err := modules.SecGroups.List(s, params)
 		if err != nil {
--- a/go.mod
+++ b/go.mod
@@ -127,12 +127,12 @@ require (
 	k8s.io/cluster-bootstrap v0.17.3
 	k8s.io/kubernetes v1.16.0
 	yunion.io/x/executor v0.0.0-20200227030256-a18417815e74
-	yunion.io/x/jsonutils v0.0.0-20200415132054-2bf8a5e94501
+	yunion.io/x/jsonutils v0.0.0-20200710080709-7ca71cdb9383
 	yunion.io/x/log v0.0.0-20200313080802-57a4ce5966b3
-	yunion.io/x/pkg v0.0.0-20200516092703-0a53bc9270aa
+	yunion.io/x/pkg v0.0.0-20200713121502-18154120c49b
 	yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e
-	yunion.io/x/sqlchemy v0.0.0-20200312002602-1177cd8fbc57
-	yunion.io/x/structarg v0.0.0-20200423163001-168d0687be7e
+	yunion.io/x/sqlchemy v0.0.0-20200702064124-195445bc4b11
+	yunion.io/x/structarg v0.0.0-20200708124353-ea9a441ecaf8
 )

 replace (
--- a/go.sum
+++ b/go.sum
@@ -1106,8 +1106,8 @@ vbom.ml/util v0.0.0-20160121211510-db5cfe13f5cc/go.mod h1:so/NYdZXCz+E3ZpW0uAoCj
 yunion.io/x/executor v0.0.0-20200227030256-a18417815e74 h1:A15C6VdVRWvmQ9pAJHrUs9yan5qKlYH7uaRxHg1kRbk=
 yunion.io/x/executor v0.0.0-20200227030256-a18417815e74/go.mod h1:Uxuou9WQIeJXNpy7t2fPLL0BYLvLiMvGQwY7Qc6aSws=
 yunion.io/x/jsonutils v0.0.0-20190625054549-a964e1e8a051/go.mod h1:4N0/RVzsYL3kH3WE/H1BjUQdFiWu50JGCFQuuy+Z634=
-yunion.io/x/jsonutils v0.0.0-20200415132054-2bf8a5e94501 h1:i1r9XvbdxH3FgTCLmTaRi3MzQqhiQimXJRlUOPgrxnU=
-yunion.io/x/jsonutils v0.0.0-20200415132054-2bf8a5e94501/go.mod h1:T7kxQJR13+t7z0TuT+Wzd7MTxBOk2H9c0pO1ONQSv90=
+yunion.io/x/jsonutils v0.0.0-20200710080709-7ca71cdb9383 h1:XEhTD+FGjBjEIWwcY0Ez1lY3oTTzjUOcRgH/i4eFM5A=
+yunion.io/x/jsonutils v0.0.0-20200710080709-7ca71cdb9383/go.mod h1:3U5hspYn9apQHaXKY+fJ4Qgwjey32Kc+Mq+mUe9NamQ=
 yunion.io/x/log v0.0.0-20190514041436-04ce53b17c6b/go.mod h1:+gauLs73omeJAPlsXcevLsJLKixV+sR/E7WSYTSx1fE=
 yunion.io/x/log v0.0.0-20190629062853-9f6483a7103d h1:59zrDL7Ft+hDukguJRmLr/Gdu/9V75x+yX99ovZwfaA=
 yunion.io/x/log v0.0.0-20190629062853-9f6483a7103d/go.mod h1:LC6f/4FozL0iaAbnFt2eDX9jlsyo3WiOUPm03d7+U4U=
@@ -1115,12 +1115,13 @@ yunion.io/x/log v0.0.0-20200313080802-57a4ce5966b3 h1:5Wc5hkB8PtMudmHuzCyok960Ru
 yunion.io/x/log v0.0.0-20200313080802-57a4ce5966b3/go.mod h1:LC6f/4FozL0iaAbnFt2eDX9jlsyo3WiOUPm03d7+U4U=
 yunion.io/x/pkg v0.0.0-20190620104149-945c25821dbf/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
 yunion.io/x/pkg v0.0.0-20190628082551-f4033ba2ea30/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
-yunion.io/x/pkg v0.0.0-20200302034534-fdf44d54b070/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
-yunion.io/x/pkg v0.0.0-20200516092703-0a53bc9270aa h1:VizPfW8+mLFEE7W/97zxQJbfdxchi2dn1M/Y7YBwTTc=
-yunion.io/x/pkg v0.0.0-20200516092703-0a53bc9270aa/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
+yunion.io/x/pkg v0.0.0-20200708071451-a663dc94e16b h1:wwPzH8iMRYjtaSM2pBN7nOqeZxR4XW5wdz2VE1KH/Ug=
+yunion.io/x/pkg v0.0.0-20200708071451-a663dc94e16b/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
+yunion.io/x/pkg v0.0.0-20200713121502-18154120c49b h1:Ov/eKwwNeQje7SggkopExzcCW/GfaUouvXkcY6RUEcM=
+yunion.io/x/pkg v0.0.0-20200713121502-18154120c49b/go.mod h1:t6rEGG2sQ4J7DhFxSZVOTjNd0YO/KlfWQyK1W4tog+E=
 yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e h1:v+EzIadodSwkdZ/7bremd7J8J50Cise/HCylsOJngmo=
 yunion.io/x/s3cli v0.0.0-20190917004522-13ac36d8687e/go.mod h1:0iFKpOs1y4lbCxeOmq3Xx/0AcQoewVPwj62eRluioEo=
-yunion.io/x/sqlchemy v0.0.0-20200312002602-1177cd8fbc57 h1:KtQAuLJ00RSUVqkiRmJ1DiDABiw0U3xxXnzD3lGavaY=
-yunion.io/x/sqlchemy v0.0.0-20200312002602-1177cd8fbc57/go.mod h1:FTdwPdGhMgh4E+UFXc9klI1Ok34fMuybTT+jLhOaIjI=
-yunion.io/x/structarg v0.0.0-20200423163001-168d0687be7e h1:pctCe/EPel3F1B83pJ2q9b34Umd1NdbLW1Yd+Lzur2s=
-yunion.io/x/structarg v0.0.0-20200423163001-168d0687be7e/go.mod h1:EP6NSv2C0zzqBDTKumv8hPWLb3XvgMZDHQRfyuOrQng=
+yunion.io/x/sqlchemy v0.0.0-20200702064124-195445bc4b11 h1:srrssomGJLh4OaDaY/1so+2FUBjZxdwQx/1pZ6403YU=
+yunion.io/x/sqlchemy v0.0.0-20200702064124-195445bc4b11/go.mod h1:FTdwPdGhMgh4E+UFXc9klI1Ok34fMuybTT+jLhOaIjI=
+yunion.io/x/structarg v0.0.0-20200708124353-ea9a441ecaf8 h1:35Q2ce/gI2cuVhsuLS7WsL2K9SxwMEtWTopt/99iYsk=
+yunion.io/x/structarg v0.0.0-20200708124353-ea9a441ecaf8/go.mod h1:EP6NSv2C0zzqBDTKumv8hPWLb3XvgMZDHQRfyuOrQng=
--- a/pkg/ansibleserver/service/handlers.go
+++ b/pkg/ansibleserver/service/handlers.go
@@ -39,6 +39,7 @@ func InitHandlers(app *appsrv.Application) {
 	db.InitAllManagers()

 	db.RegisterModelManager(db.OpsLog)
+	db.RegisterModelManager(db.Metadata)
 	db.RegisterModelManager(db.UserCacheManager)
 	db.RegisterModelManager(db.TenantCacheManager)
 	for _, manager := range []db.IModelManager{
--- a/pkg/apigateway/handler/auth.go
+++ b/pkg/apigateway/handler/auth.go
@@ -396,7 +396,7 @@ func isUserAllowWebconsole(ctx context.Context, w http.ResponseWriter, req *http
 		return false
 	}
 	if !jsonutils.QueryBoolean(usr, "allow_web_console", true) {
-		httperrors.ForbiddenError(w, "forbidden user %q login from web", usr.String())
+		httperrors.ForbiddenError(w, "user forbidden login from web")
 		return false
 	}
 	return true
--- a/pkg/apigateway/handler/misc.go
+++ b/pkg/apigateway/handler/misc.go
@@ -297,18 +297,6 @@ func (mh *MiscHandler) DoBatchUserRegister(ctx context.Context, w http.ResponseW
 			return
 		}

-		if _, ok := names[name]; ok {
-			e := httperrors.NewClientError("row %d duplicate name %s", rowIdx, name)
-			httperrors.JsonClientError(w, e)
-			return
-		} else {
-			names[name] = true
-			_, err := modules.UsersV3.Get(s, name, nil)
-			if err == nil {
-				continue
-			}
-		}
-
 		domainId, ok := domains[domain]
 		if !ok {
 			if len(domain) == 0 {
@@ -327,6 +315,18 @@ func (mh *MiscHandler) DoBatchUserRegister(ctx context.Context, w http.ResponseW
 			domains[domain] = id
 		}

+		if _, ok := names[name+"/"+domainId]; ok {
+			e := httperrors.NewClientError("row %d duplicate name %s", rowIdx, name)
+			httperrors.JsonClientError(w, e)
+			return
+		} else {
+			names[name+"/"+domainId] = true
+			_, err := modules.UsersV3.Get(s, name, nil)
+			if err == nil {
+				continue
+			}
+		}
+
 		user := jsonutils.NewDict()
 		user.Add(jsonutils.NewString(name), "name")
 		user.Add(jsonutils.NewString(domainId), "domain_id")
--- a/pkg/apigateway/options/options.go
+++ b/pkg/apigateway/options/options.go
@@ -26,7 +26,7 @@ type GatewayOptions struct {

 	DisableModuleApiVersion bool `help:"Disable each modules default api version" default:"false"`

-	EnableTotp bool `help:"Enable two-factor authentication"  default:"false"`
+	EnableTotp bool `help:"Enable two-factor authentication" default:"false"`

 	SqlitePath string `help:"sqlite db path" default:"/etc/yunion/data/yunionapi.db"`

--- a/pkg/apis/compute/dbinstance_const.go
+++ b/pkg/apis/compute/dbinstance_const.go
@@ -103,6 +103,10 @@ const (
 	HUAWEI_DBINSTANCE_CATEGORY_SINGLE  = "single"  //单机
 	HUAWEI_DBINSTANCE_CATEGORY_REPLICA = "replica" //只读

+	//谷歌云实例类型
+	GOOGLE_DBINSTANCE_CATEGORY_REGIONAL = "Regional" // 高可用性（区域级）
+	GOOGLE_DBINSTANCE_CATEGORY_ZONAL    = "Zonal"    // 单个地区
+
 	//阿里云存储类型
 	ALIYUN_DBINSTANCE_STORAGE_TYPE_LOCAL_SSD  = "local_ssd"  //本地盘SSD盘
 	ALIYUN_DBINSTANCE_STORAGE_TYPE_CLOUD_ESSD = "cloud_essd" //ESSD云盘
--- a/pkg/apis/compute/externalproject.go
+++ b/pkg/apis/compute/externalproject.go
@@ -16,9 +16,16 @@ package compute

 import "yunion.io/x/onecloud/pkg/apis"

+const (
+	EXTERNAL_PROJECT_STATUS_AVAILABLE   = "available"   // 可用
+	EXTERNAL_PROJECT_STATUS_UNAVAILABLE = "unavailable" // 不可用
+	EXTERNAL_PROJECT_STATUS_CREATING    = "creating"    // 创建中
+	EXTERNAL_PROJECT_STATUS_DELETING    = "deleting"    // 删除中
+	EXTERNAL_PROJECT_STATUS_UNKNOWN     = "unknown"     // 未知
+)
+
 type ExternalProjectDetails struct {
-	apis.StandaloneResourceDetails
-	apis.ProjectizedResourceInfo
+	apis.VirtualResourceDetails
 	ManagedResourceInfo

 	SExternalProject
--- a/pkg/apis/compute/guests.go
+++ b/pkg/apis/compute/guests.go
@@ -71,8 +71,8 @@ type ServerListInput struct {
 	// 按主机资源类型进行排序
 	// enum: shared,prepaid,dedicated
 	ResourceType string `json:"resource_type"`
-	// 返回开启主备机功能的主机
-	GetBackupGuestsOnHost *bool `json:"get_backup_guests_on_host"`
+	// 返回该宿主机上的所有虚拟机，包括备份机
+	GetAllGuestsOnHost string `json:"get_all_guests_on_host"`

 	// 根据宿主机 SN 过滤
 	// HostSn string `json:"host_sn"`
--- a/pkg/apis/compute/host.go
+++ b/pkg/apis/compute/host.go
@@ -164,7 +164,8 @@ type HostDetails struct {
 	CanPrepare        bool                `json:"can_prepare"`
 	PrepareFailReason string              `json:"prepare_fail_reason"`
 	// 允许开启宿主机健康检查
-	AllowHealthCheck bool `json:"allow_health_check"`
+	AllowHealthCheck      bool `json:"allow_health_check"`
+	AutoMigrateOnHostDown bool `json:"auto_migrate_on_host_down"`

 	// 标签
 	Metadata map[string]string `json:"metadata"`
--- a/pkg/apis/compute/input.go
+++ b/pkg/apis/compute/input.go
@@ -66,8 +66,7 @@ type CachedimageListInput struct {
 }

 type ExternalProjectListInput struct {
-	apis.StandaloneResourceListInput
-	apis.ProjectizedResourceListInput
+	apis.VirtualResourceListInput
 	apis.ExternalizedResourceBaseListInput

 	ManagedResourceListInput
--- a/pkg/apis/compute/loadbalancer.go
+++ b/pkg/apis/compute/loadbalancer.go
@@ -170,6 +170,8 @@ type LoadbalancerDetails struct {
 	ManagedResourceInfo
 	CloudregionResourceInfo

+	LoadbalancerClusterResourceInfo
+
 	VpcResourceInfoBase
 	ZoneResourceInfoBase
 	NetworkResourceInfoBase
--- a/pkg/apis/compute/secgroup.go
+++ b/pkg/apis/compute/secgroup.go
@@ -145,8 +145,18 @@ type SecgroupListInput struct {
 	// pattern:asc|desc
 	OrderByGuestCnt string `json:"order_by_guest_cnt"`

-	// 是否被修改
-	IsDirty *bool `json:"is_dirty"`
+	// 模糊过滤规则中含有指定ip的安全组
+	// example: 10.10.2.1
+	Ip string `json:"ip"`
+
+	// 精确匹配规则中含有指定端口的安全组
+	// example: 100-200
+	Ports string `json:"ports"`
+
+	// 指定过滤规则的方向(仅在指定ip或ports时生效) choices: all|in|out
+	// default: all
+	// example: in
+	Direction string `json:"direction"`
 }

 type SecurityGroupCacheListInput struct {
@@ -170,6 +180,10 @@ type SecurityGroupRuleListInput struct {
 	Action string `json:"action"`
 	// 以protocol字段过滤安全组规则
 	Protocol string `json:"protocol"`
+	// 以ports字段过滤安全组规则
+	Ports string `json:"ports"`
+	// 根据ip模糊匹配安全组规则
+	Ip string `json:"ip"`
 }

 type SecgroupResourceInput struct {
@@ -179,6 +193,11 @@ type SecgroupResourceInput struct {
 	// Deprecated
 	// filter by secgroup_id
 	SecgroupId string `json:"secgroup_id" "yunion:deprecated-by":"secgroup"`
+
+	// 模糊匹配安全组规则名称
+	SecgroupName string `json:"secgroup_name"`
+
+	apis.ProjectizedResourceInput
 }

 type SecgroupFilterListInput struct {
@@ -193,15 +212,22 @@ type SecgroupDetails struct {
 	SSecurityGroup

 	// 关联云主机数量
-	GuestCnt int `json:"guest_cnt"`
+	GuestCnt int `json:"guest_cnt,allowempty"`
+
+	// 关联此安全组的云主机is_system为true数量
+	SystemGuestCnt int `json:"system_guest_cnt,allowempty"`
+
+	// admin_secgrp_id为此安全组的云主机数量
+	AdminGuestCnt int `json:"admin_guest_cnt,allowempty"`
+
 	// 安全组缓存数量
-	CacheCnt int `json:"cache_cnt"`
+	CacheCnt int `json:"cache_cnt,allowempty"`
 	// 规则信息
-	Rules string `json:"rules"`
+	Rules []SSecurityGroupRule `json:"rules"`
 	// 入方向规则信息
-	InRules string `json:"in_rules"`
+	InRules []SSecurityGroupRule `json:"in_rules"`
 	// 出方向规则信息
-	OutRules string `json:"out_rules"`
+	OutRules []SSecurityGroupRule `json:"out_rules"`
 }

 type SecurityGroupResourceInfo struct {
--- a/pkg/apis/identity/config.go
+++ b/pkg/apis/identity/config.go
@@ -28,6 +28,8 @@ type SLDAPIdpConfigBaseOptions struct {
 	Suffix   string `json:"suffix,omitempty" required:"true"`
 	User     string `json:"user,omitempty" required:"true"`
 	Password string `json:"password,omitempty" required:"true"`
+
+	DisableUserOnImport bool `json:"disable_user_on_import"`
 }

 type SLDAPIdpConfigSingleDomainOptions struct {
@@ -51,6 +53,8 @@ type SLDAPIdpConfigOptions struct {
 	User     string `json:"user,omitempty"`
 	Password string `json:"password,omitempty"`

+	DisableUserOnImport bool `json:"disable_user_on_import"`
+
 	DomainTreeDN        string `json:"domain_tree_dn,omitempty" help:"Domain tree root node dn(distinguished name)"`
 	DomainFilter        string `json:"domain_filter,omitempty"`
 	DomainObjectclass   string `json:"domain_objectclass,omitempty"`
--- a/pkg/apis/identity/input.go
+++ b/pkg/apis/identity/input.go
@@ -151,6 +151,9 @@ type ProjectListInput struct {

 	UserFilterListInput
 	GroupFilterListInput
+
+	// 过滤出指定用户或者组可以加入的项目
+	Jointable *bool `json:"jointable"`
 }

 type DomainListInput struct {
--- a/pkg/cloudcommon/app/auth.go
+++ b/pkg/cloudcommon/app/auth.go
@@ -87,8 +87,9 @@ func InitAuth(options *common_options.CommonOptions, authComplete auth.AuthCompl

 func InitBaseAuth(options *common_options.BaseOptions) {
 	if options.EnableRbac {
-		policy.EnableGlobalRbac(time.Duration(options.RbacPolicySyncPeriodSeconds)*time.Second,
-			time.Duration(options.RbacPolicySyncFailedRetrySeconds)*time.Second,
+		policy.EnableGlobalRbac(
+			time.Second*time.Duration(options.RbacPolicySyncPeriodSeconds),
+			time.Second*time.Duration(options.RbacPolicySyncFailedRetrySeconds),
 			options.RbacDebug,
 		)
 	}
--- a/pkg/cloudcommon/db/external.go
+++ b/pkg/cloudcommon/db/external.go
@@ -66,7 +66,14 @@ func SetExternalId(model IExternalizedModel, userCred mcclient.TokenCredential,
 }

 func FetchByExternalId(manager IModelManager, idStr string) (IExternalizedModel, error) {
+	return FetchByExternalIdAndManagerId(manager, idStr, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		return q
+	})
+}
+
+func FetchByExternalIdAndManagerId(manager IModelManager, idStr string, filter func(q *sqlchemy.SQuery) *sqlchemy.SQuery) (IExternalizedModel, error) {
 	q := manager.Query().Equals("external_id", idStr)
+	q = filter(q)
 	count, err := q.CountWithError()
 	if err != nil {
 		return nil, err
--- a/pkg/cloudcommon/db/lockman/base.go
+++ b/pkg/cloudcommon/db/lockman/base.go
@@ -0,0 +1,51 @@
+package lockman
+
+import "context"
+
+type SBaseLockManager struct {
+	manager ILockManager
+}
+
+func NewBaseLockManger(m ILockManager) *SBaseLockManager {
+	return &SBaseLockManager{manager: m}
+}
+
+func (m *SBaseLockManager) LockClass(ctx context.Context, manager ILockedClass, projectId string) {
+	key := getClassKey(manager, projectId)
+	m.manager.LockKey(ctx, key)
+}
+
+func (m *SBaseLockManager) ReleaseClass(ctx context.Context, manager ILockedClass, projectId string) {
+	key := getClassKey(manager, projectId)
+	m.manager.UnlockKey(ctx, key)
+}
+
+func (m *SBaseLockManager) LockObject(ctx context.Context, model ILockedObject) {
+	key := getObjectKey(model)
+	m.manager.LockKey(ctx, key)
+}
+
+func (m *SBaseLockManager) ReleaseObject(ctx context.Context, model ILockedObject) {
+	key := getObjectKey(model)
+	m.manager.UnlockKey(ctx, key)
+}
+
+func (m *SBaseLockManager) LockRawObject(ctx context.Context, resName string, resId string) {
+	key := getRawObjectKey(resName, resId)
+	m.manager.LockKey(ctx, key)
+}
+
+func (m *SBaseLockManager) ReleaseRawObject(ctx context.Context, resName string, resId string) {
+	key := getRawObjectKey(resName, resId)
+	m.manager.UnlockKey(ctx, key)
+}
+
+func (m *SBaseLockManager) LockJointObject(ctx context.Context, model ILockedObject, model2 ILockedObject) {
+	key := getJointObjectKey(model, model2)
+	m.manager.LockKey(ctx, key)
+}
+
+func (m *SBaseLockManager) ReleaseJointObject(ctx context.Context, model ILockedObject, model2 ILockedObject) {
+	key := getJointObjectKey(model, model2)
+	m.manager.UnlockKey(ctx, key)
+}
--- a/pkg/cloudcommon/db/lockman/etcd.go
+++ b/pkg/cloudcommon/db/lockman/etcd.go
@@ -167,6 +167,7 @@ type SLockTableIndex struct {
 }

 type SEtcdLockManager struct {
+	*SBaseLockManager
 	tableLock *sync.Mutex
 	lockTable map[SLockTableIndex]*SEtcdLockRecord

@@ -203,6 +204,7 @@ func NewEtcdLockManager(config *SEtcdLockManagerConfig) (ILockManager, error) {
 		Value:  lockman,
 		Func:   atexit.ExitHandlerFunc(lockman.destroyAtExit),
 	})
+	lockman.SBaseLockManager = NewBaseLockManger(&lockman)
 	return &lockman, nil
 }

--- a/pkg/cloudcommon/db/lockman/inmemory.go
+++ b/pkg/cloudcommon/db/lockman/inmemory.go
@@ -135,12 +135,17 @@ func (rec *SInMemoryLockRecord) unlockContext(ctx context.Context) (needClean bo
 }

 type SInMemoryLockManager struct {
+	*SBaseLockManager
 	tableLock *sync.Mutex
 	lockTable map[string]*SInMemoryLockRecord
 }

 func NewInMemoryLockManager() ILockManager {
-	lockMan := SInMemoryLockManager{tableLock: &sync.Mutex{}, lockTable: make(map[string]*SInMemoryLockRecord)}
+	lockMan := SInMemoryLockManager{
+		tableLock: &sync.Mutex{},
+		lockTable: make(map[string]*SInMemoryLockRecord),
+	}
+	lockMan.SBaseLockManager = NewBaseLockManger(&lockMan)
 	return &lockMan
 }

--- a/pkg/cloudcommon/db/lockman/lockman.go
+++ b/pkg/cloudcommon/db/lockman/lockman.go
@@ -31,6 +31,15 @@ type ILockedObject interface {
 type ILockManager interface {
 	LockKey(ctx context.Context, key string)
 	UnlockKey(ctx context.Context, key string)
+
+	LockClass(ctx context.Context, manager ILockedClass, projectId string)
+	ReleaseClass(ctx context.Context, manager ILockedClass, projectId string)
+	LockObject(ctx context.Context, model ILockedObject)
+	ReleaseObject(ctx context.Context, model ILockedObject)
+	LockRawObject(ctx context.Context, resName string, resId string)
+	ReleaseRawObject(ctx context.Context, resName string, resId string)
+	LockJointObject(ctx context.Context, model ILockedObject, model2 ILockedObject)
+	ReleaseJointObject(ctx context.Context, model ILockedObject, model2 ILockedObject)
 }

 func getClassKey(manager ILockedClass, projectId string) string {
@@ -64,41 +73,33 @@ func Init(man ILockManager) {
 }

 func LockClass(ctx context.Context, manager ILockedClass, projectId string) {
-	key := getClassKey(manager, projectId)
-	_lockman.LockKey(ctx, key)
+	_lockman.LockClass(ctx, manager, projectId)
 }

 func ReleaseClass(ctx context.Context, manager ILockedClass, projectId string) {
-	key := getClassKey(manager, projectId)
-	_lockman.UnlockKey(ctx, key)
+	_lockman.ReleaseClass(ctx, manager, projectId)
 }

 func LockObject(ctx context.Context, model ILockedObject) {
-	key := getObjectKey(model)
-	_lockman.LockKey(ctx, key)
+	_lockman.LockObject(ctx, model)
 }

 func ReleaseObject(ctx context.Context, model ILockedObject) {
-	key := getObjectKey(model)
-	_lockman.UnlockKey(ctx, key)
+	_lockman.ReleaseObject(ctx, model)
 }

 func LockRawObject(ctx context.Context, resName string, resId string) {
-	key := getRawObjectKey(resName, resId)
-	_lockman.LockKey(ctx, key)
+	_lockman.LockRawObject(ctx, resName, resId)
 }

 func ReleaseRawObject(ctx context.Context, resName string, resId string) {
-	key := getRawObjectKey(resName, resId)
-	_lockman.UnlockKey(ctx, key)
+	_lockman.ReleaseRawObject(ctx, resName, resId)
 }

 func LockJointObject(ctx context.Context, model ILockedObject, model2 ILockedObject) {
-	key := getJointObjectKey(model, model2)
-	_lockman.LockKey(ctx, key)
+	_lockman.LockJointObject(ctx, model, model2)
 }

 func ReleaseJointObject(ctx context.Context, model ILockedObject, model2 ILockedObject) {
-	key := getJointObjectKey(model, model2)
-	_lockman.UnlockKey(ctx, key)
+	_lockman.ReleaseJointObject(ctx, model, model2)
 }
--- a/pkg/cloudcommon/db/lockman/noop.go
+++ b/pkg/cloudcommon/db/lockman/noop.go
@@ -21,6 +21,7 @@ import (
 )

 type SNoopLockManager struct {
+	*SBaseLockManager
 }

 func (lockman *SNoopLockManager) LockKey(ctx context.Context, key string) {
@@ -33,5 +34,6 @@ func (lockman *SNoopLockManager) UnlockKey(ctx context.Context, key string) {

 func NewNoopLockManager() ILockManager {
 	lockMan := SNoopLockManager{}
+	lockMan.SBaseLockManager = NewBaseLockManger(&lockMan)
 	return &lockMan
 }
--- a/pkg/cloudcommon/db/opslog.go
+++ b/pkg/cloudcommon/db/opslog.go
@@ -621,17 +621,11 @@ func (self *SOpsLogManager) FilterByOwner(q *sqlchemy.SQuery, ownerId mcclient.I
 			}
 		case rbacutils.ScopeProject:
 			if len(ownerId.GetProjectId()) > 0 {
-				q = q.Filter(sqlchemy.OR(
-					sqlchemy.Equals(q.Field("owner_tenant_id"), ownerId.GetProjectId()),
-					sqlchemy.Equals(q.Field("tenant_id"), ownerId.GetProjectId()),
-				))
+				q = q.Filter(sqlchemy.Equals(q.Field("tenant_id"), ownerId.GetProjectId()))
 			}
 		case rbacutils.ScopeDomain:
 			if len(ownerId.GetProjectDomainId()) > 0 {
-				q = q.Filter(sqlchemy.OR(
-					sqlchemy.Equals(q.Field("owner_domain_id"), ownerId.GetProjectDomainId()),
-					sqlchemy.Equals(q.Field("domain_id"), ownerId.GetProjectDomainId()),
-				))
+				q = q.Filter(sqlchemy.Equals(q.Field("domain_id"), ownerId.GetProjectDomainId()))
 			}
 		default:
 			// systemScope, no filter
--- a/pkg/cloudcommon/db/quotas/handler.go
+++ b/pkg/cloudcommon/db/quotas/handler.go
@@ -20,6 +20,7 @@ import (
 	"fmt"
 	"net/http"
 	"reflect"
+	"sort"
 	"strings"

 	"yunion.io/x/jsonutils"
@@ -481,7 +482,7 @@ func (manager *SQuotaBaseManager) listDomainQuotaHandler(ctx context.Context, w
 		httperrors.GeneralServerError(w, err)
 		return
 	}
-	manager.sendQuotaList(w, quotaList)
+	manager.sendQuotaList(w, sortQuotaByUsage(quotaList))
 }

 func (manager *SQuotaBaseManager) sendQuotaList(w http.ResponseWriter, quotaList []jsonutils.JSONObject) {
@@ -524,7 +525,7 @@ func (manager *SQuotaBaseManager) listProjectQuotaHandler(ctx context.Context, w
 		httperrors.GeneralServerError(w, err)
 		return
 	}
-	manager.sendQuotaList(w, quotaList)
+	manager.sendQuotaList(w, sortQuotaByUsage(quotaList))
 }

 func (manager *SQuotaBaseManager) listQuotas(ctx context.Context, userCred mcclient.TokenCredential, targetDomainId string, targetProjectId string, domainOnly bool, primaryOnly bool, refresh bool) ([]jsonutils.JSONObject, error) {
@@ -616,3 +617,33 @@ func (manager *SQuotaBaseManager) listQuotas(ctx context.Context, userCred mccli
 	}
 	return ret, nil
 }
+
+type tQuotaResultList []jsonutils.JSONObject
+
+func (a tQuotaResultList) Len() int           { return len(a) }
+func (a tQuotaResultList) Swap(i, j int)      { a[i], a[j] = a[j], a[i] }
+func (a tQuotaResultList) Less(i, j int) bool { return usageRateOfQuota(a[i]) > usageRateOfQuota(a[j]) }
+
+func usageRateOfQuota(quota jsonutils.JSONObject) float32 {
+	maxRate := float32(0)
+	quotaMap, _ := quota.GetMap()
+	for k, v := range quotaMap {
+		usageK := fmt.Sprintf("usage.%s", k)
+		if usageV, ok := quotaMap[usageK]; ok {
+			intV, _ := v.Int()
+			if intV > 0 {
+				intUsageV, _ := usageV.Int()
+				rate := float32(intUsageV) / float32(intV)
+				if maxRate < rate {
+					maxRate = rate
+				}
+			}
+		}
+	}
+	return maxRate
+}
+
+func sortQuotaByUsage(quotaList []jsonutils.JSONObject) []jsonutils.JSONObject {
+	sort.Sort(tQuotaResultList(quotaList))
+	return quotaList
+}
--- a/pkg/cloudcommon/db/sharablebase.go
+++ b/pkg/cloudcommon/db/sharablebase.go
@@ -162,8 +162,14 @@ func SharableManagerValidateCreateData(
 			input.IsPublic = &isPublic
 			reqScope = rbacutils.ScopeSystem
 		} else if input.PublicScope == string(rbacutils.ScopeDomain) {
-			input.IsPublic = &isPublic
-			reqScope = rbacutils.ScopeDomain
+			if consts.GetNonDefaultDomainProjects() {
+				// only if non_default_domain_projects turned on, allow sharing to domain
+				input.IsPublic = &isPublic
+				reqScope = rbacutils.ScopeDomain
+			} else {
+				input.IsPublic = &isPublic
+				reqScope = rbacutils.ScopeSystem
+			}
 		} else if input.IsPublic != nil && *input.IsPublic && len(input.PublicScope) == 0 {
 			// backward compatible, if only is_public is true, make it share to system
 			input.IsPublic = &isPublic
@@ -174,17 +180,23 @@ func SharableManagerValidateCreateData(
 			input.PublicScope = "" // string(rbacutils.ScopeNone)
 		}
 	case rbacutils.ScopeDomain:
-		if input.PublicScope == string(rbacutils.ScopeSystem) {
-			input.IsPublic = &isPublic
-			reqScope = rbacutils.ScopeSystem
-		} else if input.IsPublic != nil && *input.IsPublic && len(input.PublicScope) == 0 {
-			// backward compatible, if only is_public is true, make it share to system
-			input.IsPublic = &isPublic
-			input.PublicScope = string(rbacutils.ScopeSystem)
-			reqScope = rbacutils.ScopeSystem
+		if consts.GetNonDefaultDomainProjects() {
+			// only if non_default_domain_projects turned on, allow sharing domain resources
+			if input.PublicScope == string(rbacutils.ScopeSystem) {
+				input.IsPublic = &isPublic
+				reqScope = rbacutils.ScopeSystem
+			} else if input.IsPublic != nil && *input.IsPublic && len(input.PublicScope) == 0 {
+				// backward compatible, if only is_public is true, make it share to system
+				input.IsPublic = &isPublic
+				input.PublicScope = string(rbacutils.ScopeSystem)
+				reqScope = rbacutils.ScopeSystem
+			} else {
+				input.IsPublic = nil
+				input.PublicScope = "" // string(rbacutils.ScopeNone)
+			}
 		} else {
 			input.IsPublic = nil
-			input.PublicScope = "" // string(rbacutils.ScopeNone)
+			input.PublicScope = string(rbacutils.ScopeNone)
 		}
 	default:
 		return input, errors.Wrap(httperrors.ErrInputParameter, "the resource is not sharable")
@@ -423,6 +435,9 @@ func SharablePerformPublic(model ISharableBaseModel, ctx context.Context, userCr
 			targetScope = rbacutils.ScopeNone
 		}
 	case rbacutils.ScopeDomain:
+		if !consts.GetNonDefaultDomainProjects() {
+			return errors.Wrap(httperrors.ErrForbidden, "not allow to share to domain when non_default_domain_projects turned off")
+		}
 		if len(requireIds) == 0 {
 			return errors.Wrap(httperrors.ErrForbidden, "require to be shared to system")
 		}
@@ -555,7 +570,8 @@ func SharableModelIsShared(model ISharableBaseModel) bool {
 func SharableModelCustomizeCreate(model ISharableBaseModel, ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, query jsonutils.JSONObject, data jsonutils.JSONObject) error {
 	if !data.Contains("public_scope") {
 		resScope := model.GetModelManager().ResourceScope()
-		if resScope == rbacutils.ScopeDomain {
+		if resScope == rbacutils.ScopeDomain && consts.GetNonDefaultDomainProjects() {
+			// only if non_default_domain_projects turned on, do the following
 			isManaged := false
 			if managedModel, ok := model.(IManagedResourceBase); ok {
 				isManaged = managedModel.IsManaged()
--- a/pkg/cloudcommon/policy/policy.go
+++ b/pkg/cloudcommon/policy/policy.go
@@ -20,6 +20,7 @@ import (
 	"sort"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"

 	"yunion.io/x/jsonutils"
@@ -191,11 +192,33 @@ func (manager *SPolicyManager) start(refreshInterval time.Duration, retryInterva

 	manager.cache = hashcache.NewCache(2048, manager.refreshInterval/2)

-	manager.SyncOnce()
+	manager.syncByInterval()
 }

+func (manager *SPolicyManager) syncByInterval() {
+	syncWorkerManager.Run(manager.syncByInterval_, nil, nil)
+}
+
+func (manager *SPolicyManager) syncByInterval_() {
+	err := manager.doSync()
+	var interval time.Duration
+	if err != nil {
+		interval = manager.failedRetryInterval
+	} else {
+		interval = manager.refreshInterval
+	}
+	time.AfterFunc(interval, manager.syncByInterval)
+}
+
+var syncOnce int32
+
 func (manager *SPolicyManager) SyncOnce() {
-	syncWorkerManager.Run(manager.sync, nil, nil)
+	if atomic.CompareAndSwapInt32(&syncOnce, 0, 1) {
+		syncWorkerManager.Run(func() {
+			atomic.StoreInt32(&syncOnce, 0)
+			manager.doSync()
+		}, nil, nil)
+	}
 }

 func (manager *SPolicyManager) doSync() error {
@@ -223,17 +246,6 @@ func (manager *SPolicyManager) doSync() error {
 	return nil
 }

-func (manager *SPolicyManager) sync() {
-	err := manager.doSync()
-	var interval time.Duration
-	if err != nil {
-		interval = manager.failedRetryInterval
-	} else {
-		interval = manager.refreshInterval
-	}
-	time.AfterFunc(interval, manager.SyncOnce)
-}
-
 func queryKey(scope rbacutils.TRbacScope, userCred mcclient.TokenCredential, service string, resource string, action string, extra ...string) string {
 	queryKeys := []string{string(scope)}
 	queryKeys = append(queryKeys, userCred.GetProjectId(), userCred.GetDomainId(), userCred.GetUserId())
--- a/pkg/cloudprovider/images.go
+++ b/pkg/cloudprovider/images.go
@@ -49,6 +49,7 @@ type SImage struct {
 	Status     string
 	// UpdatedAt       time.Time
 	PublicScope string
+	ExternalId  string
 }

 func CloudImage2Image(image ICloudImage) SImage {
--- a/pkg/compute/guestdrivers/azure.go
+++ b/pkg/compute/guestdrivers/azure.go
@@ -124,6 +124,30 @@ func (self *SAzureGuestDriver) ValidateResizeDisk(guest *models.SGuest, disk *mo
 	return nil
 }

+func (self *SAzureGuestDriver) ValidateImage(ctx context.Context, image *cloudprovider.SImage) error {
+	if len(image.ExternalId) == 0 {
+		s := auth.GetAdminSession(ctx, options.Options.Region, "")
+		result, err := modules.Images.GetSpecific(s, image.Id, "subformats", nil)
+		if err != nil {
+			return errors.Wrap(err, "get subformats")
+		}
+		subFormats := []struct {
+			Format string
+		}{}
+		err = result.Unmarshal(&subFormats)
+		if err != nil {
+			return errors.Wrap(err, "Unmarshal subformats")
+		}
+		for i := range subFormats {
+			if subFormats[i].Format == "vhd" {
+				return nil
+			}
+		}
+		return httperrors.NewResourceNotFoundError("failed to find subformat vhd for image %s, please append 'vhd' for glance options(target_image_formats)", image.Name)
+	}
+	return nil
+}
+
 func (self *SAzureGuestDriver) ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, input *api.ServerCreateInput) (*api.ServerCreateInput, error) {
 	input, err := self.SManagedVirtualizedGuestDriver.ValidateCreateData(ctx, userCred, input)
 	if err != nil {
@@ -137,59 +161,45 @@ func (self *SAzureGuestDriver) ValidateCreateData(ctx context.Context, userCred
 		if err != nil {
 			return nil, errors.Wrap(err, "FetchById")
 		}
-		image := _image.(*models.SCachedimage)
-		if len(image.ExternalId) == 0 {
-			s := auth.GetAdminSession(ctx, options.Options.Region, "")
-			result, err := modules.Images.GetSpecific(s, image.Id, "subformats", nil)
-			if err != nil {
-				return nil, errors.Wrap(err, "get subformats")
-			}
-			subFormats := []struct {
-				Format string
-			}{}
-			err = result.Unmarshal(&subFormats)
-			if err != nil {
-				return nil, errors.Wrap(err, "Unmarshal subformats")
-			}
-			find := false
-			for i := range subFormats {
-				if subFormats[i].Format == "vhd" {
-					find = true
-					break
+
+		cachedimage := _image.(*models.SCachedimage)
+		image, err := cachedimage.GetImage()
+		if err != nil {
+			return nil, errors.Wrap(err, "GetImage")
+		}
+
+		err = self.ValidateImage(ctx, image)
+		if err != nil {
+			return nil, err
+		}
+
+		if len(image.ExternalId) > 0 && len(input.InstanceType) > 0 {
+			if cachedimage.UEFI.IsFalse() {
+				if strings.HasPrefix(input.InstanceType, "Standard_M") && strings.HasSuffix(input.InstanceType, "v2") {
+					return nil, httperrors.NewNotSupportedError("Azure Mv2-series instance sku only support UEFI image")
 				}
-			}
-			if !find {
-				return nil, httperrors.NewResourceNotFoundError("failed to find subformat vhd for image %s, please append 'vhd' for glance options(target_image_formats)", image.Name)
-			}
-		} else {
-			if len(input.InstanceType) > 0 {
-				if image.UEFI.IsFalse() {
-					if strings.HasPrefix(input.InstanceType, "Standard_M") && strings.HasSuffix(input.InstanceType, "v2") {
-						return nil, httperrors.NewNotSupportedError("Azure Mv2-series instance sku only support UEFI image")
-					}
-				} else {
-					// https://docs.microsoft.com/en-us/azure/virtual-machines/windows/generation-2
-					if !(strings.HasPrefix(input.InstanceType, "Standard_B") || // B-series
-						(strings.HasPrefix(input.InstanceType, "Standard_DC") && strings.HasSuffix(input.InstanceType, "s_v2") || input.InstanceType == "Standard_DC8_v2") || // DCsv2-series
-						(strings.HasPrefix(input.InstanceType, "Standard_DS") && strings.HasSuffix(input.InstanceType, "v2")) || // DSv2-series
-						(strings.HasPrefix(input.InstanceType, "Standard_DS") && strings.HasSuffix(input.InstanceType, "s_v3")) || // Dsv3-series
-						(strings.HasPrefix(input.InstanceType, "Standard_D") && strings.HasSuffix(input.InstanceType, "as_v4")) || // Dasv4-series
-						(strings.HasPrefix(input.InstanceType, "Standard_E") && strings.HasSuffix(input.InstanceType, "s_v3")) || // Esv3-series
-						(strings.HasPrefix(input.InstanceType, "Standard_E") && strings.HasSuffix(input.InstanceType, "as_v4")) || // Easv4-series
-						(strings.HasPrefix(input.InstanceType, "Standard_F") && strings.HasSuffix(input.InstanceType, "s_v2")) || // Fsv2-series
-						(strings.HasPrefix(input.InstanceType, "Standard_GS")) || // GS-series
-						(strings.HasPrefix(input.InstanceType, "Standard_HB")) || // HB-series
-						(strings.HasPrefix(input.InstanceType, "Standard_HC")) || // HC-series
-						(strings.HasPrefix(input.InstanceType, "Standard_L") && strings.HasSuffix(input.InstanceType, "s")) || // Ls-series
-						(strings.HasPrefix(input.InstanceType, "Standard_L") && strings.HasSuffix(input.InstanceType, "s_v2")) || // Ls-series
-						(strings.HasPrefix(input.InstanceType, "Standard_M")) || // M-series
-						(strings.HasPrefix(input.InstanceType, "Standard_M") && strings.HasSuffix(input.InstanceType, "s_v2")) || // Mv2-series
-						(strings.HasPrefix(input.InstanceType, "Standard_NC") && strings.HasSuffix(input.InstanceType, "s_v2")) || // NCv2-series
-						(strings.HasPrefix(input.InstanceType, "Standard_NC") && strings.HasSuffix(input.InstanceType, "s_v3")) || // NCv3-series
-						(strings.HasPrefix(input.InstanceType, "Standard_ND")) || // ND-series
-						(strings.HasPrefix(input.InstanceType, "Standard_NV") && strings.HasSuffix(input.InstanceType, "s_v3"))) { // NVv3-series
-						return nil, httperrors.NewUnsupportOperationError("Azure UEFI image %s not support this instance sku", image.Name)
-					}
+			} else {
+				// https://docs.microsoft.com/en-us/azure/virtual-machines/windows/generation-2
+				if !(strings.HasPrefix(input.InstanceType, "Standard_B") || // B-series
+					(strings.HasPrefix(input.InstanceType, "Standard_DC") && strings.HasSuffix(input.InstanceType, "s_v2") || input.InstanceType == "Standard_DC8_v2") || // DCsv2-series
+					(strings.HasPrefix(input.InstanceType, "Standard_DS") && strings.HasSuffix(input.InstanceType, "v2")) || // DSv2-series
+					(strings.HasPrefix(input.InstanceType, "Standard_DS") && strings.HasSuffix(input.InstanceType, "s_v3")) || // Dsv3-series
+					(strings.HasPrefix(input.InstanceType, "Standard_D") && strings.HasSuffix(input.InstanceType, "as_v4")) || // Dasv4-series
+					(strings.HasPrefix(input.InstanceType, "Standard_E") && strings.HasSuffix(input.InstanceType, "s_v3")) || // Esv3-series
+					(strings.HasPrefix(input.InstanceType, "Standard_E") && strings.HasSuffix(input.InstanceType, "as_v4")) || // Easv4-series
+					(strings.HasPrefix(input.InstanceType, "Standard_F") && strings.HasSuffix(input.InstanceType, "s_v2")) || // Fsv2-series
+					(strings.HasPrefix(input.InstanceType, "Standard_GS")) || // GS-series
+					(strings.HasPrefix(input.InstanceType, "Standard_HB")) || // HB-series
+					(strings.HasPrefix(input.InstanceType, "Standard_HC")) || // HC-series
+					(strings.HasPrefix(input.InstanceType, "Standard_L") && strings.HasSuffix(input.InstanceType, "s")) || // Ls-series
+					(strings.HasPrefix(input.InstanceType, "Standard_L") && strings.HasSuffix(input.InstanceType, "s_v2")) || // Ls-series
+					(strings.HasPrefix(input.InstanceType, "Standard_M")) || // M-series
+					(strings.HasPrefix(input.InstanceType, "Standard_M") && strings.HasSuffix(input.InstanceType, "s_v2")) || // Mv2-series
+					(strings.HasPrefix(input.InstanceType, "Standard_NC") && strings.HasSuffix(input.InstanceType, "s_v2")) || // NCv2-series
+					(strings.HasPrefix(input.InstanceType, "Standard_NC") && strings.HasSuffix(input.InstanceType, "s_v3")) || // NCv3-series
+					(strings.HasPrefix(input.InstanceType, "Standard_ND")) || // ND-series
+					(strings.HasPrefix(input.InstanceType, "Standard_NV") && strings.HasSuffix(input.InstanceType, "s_v3"))) { // NVv3-series
+					return nil, httperrors.NewUnsupportOperationError("Azure UEFI image %s not support this instance sku", image.Name)
 				}
 			}
 		}
--- a/pkg/compute/guestdrivers/base.go
+++ b/pkg/compute/guestdrivers/base.go
@@ -89,6 +89,10 @@ func (self *SBaseGuestDriver) StartDeleteGuestTask(ctx context.Context, userCred
 	return nil
 }

+func (self *SBaseGuestDriver) ValidateImage(ctx context.Context, image *cloudprovider.SImage) error {
+	return nil
+}
+
 func (self *SBaseGuestDriver) RequestDetachDisksFromGuestForDelete(ctx context.Context, guest *models.SGuest, task taskman.ITask) error {
 	task.ScheduleRun(nil)
 	return nil
--- a/pkg/compute/guestdrivers/esxi.go
+++ b/pkg/compute/guestdrivers/esxi.go
@@ -172,7 +172,7 @@ func (self *SESXiGuestDriver) GetJsonDescAtHost(ctx context.Context, userCred mc
 	if img.ImageType != cloudprovider.CachedImageTypeSystem {
 		return desc
 	}
-	sciSubQ := models.StoragecachedimageManager.Query("storagecache_id").Equals("cachedimage_id", templateId).SubQuery()
+	sciSubQ := models.StoragecachedimageManager.Query("storagecache_id").Equals("cachedimage_id", templateId).Equals("status", api.CACHED_IMAGE_STATUS_READY).SubQuery()
 	scQ := models.StoragecacheManager.Query().In("id", sciSubQ)
 	storageCaches := make([]models.SStoragecache, 0, 1)
 	err = db.FetchModelObjects(models.StoragecacheManager, scQ, &storageCaches)
@@ -234,10 +234,32 @@ func (self *SESXiGuestDriver) RequestDeployGuestOnHost(ctx context.Context, gues
 	}
 	config.Add(jsonutils.NewString(extId), "guest_ext_id")

-	accessInfo, err := host.GetCloudaccount().GetVCenterAccessInfo(storage.ExternalId)
+	account := host.GetCloudaccount()
+	accessInfo, err := account.GetVCenterAccessInfo(storage.ExternalId)
 	if err != nil {
 		return err
 	}
+
+	action, _ := config.GetString("action")
+	if action == "create" {
+		project, err := db.TenantCacheManager.FetchTenantById(ctx, guest.ProjectId)
+		if err != nil {
+			return errors.Wrapf(err, "FetchTenantById(%s)", guest.ProjectId)
+		}
+
+		projects, err := account.GetExternalProjectsByProjectIdOrName(project.Id, project.Name)
+		if err != nil {
+			return errors.Wrapf(err, "GetExternalProjectsByProjectIdOrName(%s,%s)", project.Id, project.Name)
+		}
+
+		extProj := account.GetAvailableExternalProject(project, projects)
+		if extProj != nil {
+			config.Add(jsonutils.NewString(extProj.Name), "desc", "resource_pool")
+		} else {
+			config.Add(jsonutils.NewString(project.Name), "desc", "resource_pool")
+		}
+	}
+
 	config.Add(jsonutils.Marshal(accessInfo), "datastore")

 	url := "/disks/agent/deploy"
--- a/pkg/compute/guestdrivers/managedvirtual.go
+++ b/pkg/compute/guestdrivers/managedvirtual.go
@@ -27,6 +27,7 @@ import (
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/osprofile"
 	"yunion.io/x/pkg/utils"
+	"yunion.io/x/sqlchemy"

 	billing_api "yunion.io/x/onecloud/pkg/apis/billing"
 	api "yunion.io/x/onecloud/pkg/apis/compute"
@@ -449,7 +450,9 @@ func (self *SManagedVirtualizedGuestDriver) RemoteDeployGuestForCreate(ctx conte
 		}

 		if hostId := iVM.GetIHostId(); len(hostId) > 0 {
-			host, err := db.FetchByExternalId(models.HostManager, hostId)
+			host, err := db.FetchByExternalIdAndManagerId(models.HostManager, hostId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", host.ManagerId)
+			})
 			if err != nil {
 				log.Warningf("failed to found new hostId(%s) for ivm %s(%s) error: %v", hostId, guest.Name, guest.Id, err)
 			} else if host.GetId() != guest.HostId {
@@ -886,7 +889,13 @@ func (self *SManagedVirtualizedGuestDriver) OnGuestDeployTaskDataReceived(ctx co
 				}

 				if len(diskInfo[i].StorageExternalId) > 0 {
-					storage, err := db.FetchByExternalId(models.StorageManager, diskInfo[i].StorageExternalId)
+					storage, err := db.FetchByExternalIdAndManagerId(models.StorageManager, diskInfo[i].StorageExternalId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+						host := guest.GetHost()
+						if host != nil {
+							return q.Equals("manager_id", host.ManagerId)
+						}
+						return q
+					})
 					if err != nil {
 						log.Warningf("failed to found storage by externalId %s error: %v", diskInfo[i].StorageExternalId, err)
 					} else if disk.StorageId != storage.GetId() {
--- a/pkg/compute/hostdrivers/managedvirtual.go
+++ b/pkg/compute/hostdrivers/managedvirtual.go
@@ -275,7 +275,7 @@ func (self *SManagedVirtualizationHostDriver) RequestAllocateDiskOnStorage(ctx c

 		cloudprovider.WaitStatus(iDisk, api.DISK_READY, time.Second*5, time.Minute*5)

-		models.SyncMetadata(ctx, task.GetUserCred(), disk, iDisk)
+		models.SyncVirtualResourceMetadata(ctx, task.GetUserCred(), disk, iDisk)

 		data := jsonutils.NewDict()
 		data.Add(jsonutils.NewInt(int64(iDisk.GetDiskSizeMB())), "disk_size")
--- a/pkg/compute/models/cachedimages.go
+++ b/pkg/compute/models/cachedimages.go
@@ -175,7 +175,9 @@ func (self *SCachedimage) getStoragecacheCount() (int, error) {
 }

 func (self *SCachedimage) GetImage() (*cloudprovider.SImage, error) {
-	image := cloudprovider.SImage{}
+	image := cloudprovider.SImage{
+		ExternalId: self.ExternalId,
+	}

 	err := self.Info.Unmarshal(&image)
 	if err != nil {
--- a/pkg/compute/models/capabilities.go
+++ b/pkg/compute/models/capabilities.go
@@ -315,10 +315,10 @@ type StorageInfo struct {
 	Name            string
 	VirtualCapacity int64
 	Capacity        int64
-	Reserved        int64
+	Reserved        sql.NullInt64
 	StorageType     string
 	MediumType      string
-	Cmtbound        float32
+	Cmtbound        sql.NullFloat64
 	UsedCapacity    sql.NullInt64
 	WasteCapacity   sql.NullInt64
 	FreeCapacity    int64
@@ -440,7 +440,7 @@ func getStorageTypes(
 		addStorageInfo = func(storage *StorageInfo, simpleStorage *SimpleStorageInfo) {
 			simpleStorage.VirtualCapacity += storage.VirtualCapacity
 			simpleStorage.FreeCapacity += storage.FreeCapacity
-			simpleStorage.Reserved += storage.Reserved
+			simpleStorage.Reserved += storage.Reserved.Int64
 			simpleStorage.Capacity += storage.Capacity
 			simpleStorage.WasteCapacity += storage.WasteCapacity.Int64
 			simpleStorage.UsedCapacity += storage.UsedCapacity.Int64
@@ -493,10 +493,10 @@ func getStorageTypes(
 				}
 				allStorageTypes = append(allStorageTypes, storageType)
 			}
-			if storage.Cmtbound == 0 {
-				storage.Cmtbound = options.Options.DefaultStorageOvercommitBound
+			if storage.Cmtbound.Float64 == 0 {
+				storage.Cmtbound.Float64 = float64(options.Options.DefaultStorageOvercommitBound)
 			}
-			storage.VirtualCapacity = int64(float32((storage.Capacity - storage.Reserved)) * storage.Cmtbound)
+			storage.VirtualCapacity = int64(float64(storage.Capacity-storage.Reserved.Int64) * storage.Cmtbound.Float64)
 			storage.FreeCapacity = storage.VirtualCapacity - storage.UsedCapacity.Int64 - storage.WasteCapacity.Int64
 			addStorageInfo(&storage, simpleStorage)
 			storageInfos[storageType] = simpleStorage
--- a/pkg/compute/models/cloudaccounts.go
+++ b/pkg/compute/models/cloudaccounts.go
@@ -1900,6 +1900,7 @@ func (account *SCloudaccount) SubmitSyncAccountTask(ctx context.Context, userCre
 	if _, ok := cloudaccountPendingSyncs[account.Id]; ok {
 		if waitChan != nil {
 			// an active cloudaccount sync task is running, return with conflict error
+			log.Errorf("an active cloudaccount sync task is running, early return with conflict error")
 			waitChan <- errors.Wrap(httperrors.ErrConflict, "cloudaccountPendingSyncs")
 		}
 		return
@@ -1918,8 +1919,9 @@ func (account *SCloudaccount) SubmitSyncAccountTask(ctx context.Context, userCre
 		if waitChan != nil {
 			if err != nil {
 				account.markEndSync(userCred)
+				err = errors.Wrap(err, "account.syncAccountStatus")
 			}
-			waitChan <- errors.Wrap(err, "account.syncAccountStatus")
+			waitChan <- err
 		} else {
 			syncCnt := 0
 			if err == nil && autoSync && account.GetEnabled() && account.EnableAutoSync {
@@ -1954,6 +1956,16 @@ func (self *SCloudaccount) Delete(ctx context.Context, userCred mcclient.TokenCr

 func (self *SCloudaccount) RealDelete(ctx context.Context, userCred mcclient.TokenCredential) error {
 	self.SetStatus(userCred, api.CLOUD_PROVIDER_DELETED, "real delete")
+	projects, err := self.GetExternalProjects()
+	if err != nil {
+		return errors.Wrap(err, "GetExternalProjects")
+	}
+	for i := range projects {
+		err = projects[i].Delete(ctx, userCred)
+		if err != nil {
+			return errors.Wrapf(err, "project %s Delete", projects[i].Id)
+		}
+	}
 	return self.SEnabledStatusInfrasResourceBase.Delete(ctx, userCred)
 }

@@ -2284,6 +2296,32 @@ func (account *SCloudaccount) PerformSyncSkus(ctx context.Context, userCred mccl
 	return nil, nil
 }

+func (self *SCloudaccount) GetExternalProjects() ([]SExternalProject, error) {
+	projects := []SExternalProject{}
+	q := ExternalProjectManager.Query().Equals("cloudaccount_id", self.Id)
+	err := db.FetchModelObjects(ExternalProjectManager, q, &projects)
+	if err != nil {
+		return nil, errors.Wrap(err, "db.FetchModelObjects")
+	}
+	return projects, nil
+}
+
+func (self *SCloudaccount) GetExternalProjectsByProjectIdOrName(projectId, name string) ([]SExternalProject, error) {
+	projects := []SExternalProject{}
+	q := ExternalProjectManager.Query().Equals("cloudaccount_id", self.Id)
+	q = q.Filter(
+		sqlchemy.OR(
+			sqlchemy.Equals(q.Field("name"), name),
+			sqlchemy.Equals(q.Field("tenant_id"), projectId),
+		),
+	)
+	err := db.FetchModelObjects(ExternalProjectManager, q, &projects)
+	if err != nil {
+		return nil, errors.Wrap(err, "db.FetchModelObjects")
+	}
+	return projects, nil
+}
+
 func (manager *SCloudaccountManager) queryCloudAccountByCapability(region *SCloudregion, zone *SZone, domainId string, enabled tristate.TriState, capability string) *sqlchemy.SQuery {
 	providers := CloudproviderManager.Query().SubQuery()
 	q := manager.Query()
@@ -2375,3 +2413,78 @@ func (account *SCloudaccount) GetUsages() []db.IUsage {
 		&usage,
 	}
 }
+
+func (self *SCloudaccount) GetAvailableExternalProject(local *db.STenant, projects []SExternalProject) *SExternalProject {
+	var ret *SExternalProject = nil
+	for i := 0; i < len(projects); i++ {
+		if projects[i].Status == api.EXTERNAL_PROJECT_STATUS_AVAILABLE {
+			if projects[i].ProjectId == local.Id {
+				return &projects[i]
+			}
+			if projects[i].Name == local.Name {
+				ret = &projects[i]
+			}
+		}
+	}
+	return ret
+}
+
+// 若本地项目映射了多个云上项目，则在云上随机找一个项目
+// 若本地项目没有映射云上任何项目，则在云上新建一个同名项目
+// 若本地项目a映射云上项目b，但b项目不可用,则看云上是否有a项目，有则直接使用,若没有则在云上创建a-1, a-2类似项目
+func (self *SCloudaccount) SyncProject(ctx context.Context, userCred mcclient.TokenCredential, projectId string) (string, error) {
+	lockman.LockRawObject(ctx, self.Id, projectId)
+	defer lockman.ReleaseRawObject(ctx, self.Id, projectId)
+
+	provider, err := self.GetProvider()
+	if err != nil {
+		return "", errors.Wrap(err, "GetProvider")
+	}
+
+	if !cloudprovider.IsSupportProject(provider) {
+		return "", nil
+	}
+
+	project, err := db.TenantCacheManager.FetchTenantById(ctx, projectId)
+	if err != nil {
+		return "", errors.Wrapf(err, "FetchTenantById(%s)", projectId)
+	}
+
+	projects, err := self.GetExternalProjectsByProjectIdOrName(projectId, project.Name)
+	if err != nil {
+		return "", errors.Wrapf(err, "GetExternalProjectsByProjectIdOrName(%s,%s)", projectId, project.Name)
+	}
+
+	extProj := self.GetAvailableExternalProject(project, projects)
+	if extProj != nil {
+		return extProj.ExternalId, nil
+	}
+
+	retry := 1
+	if len(projects) > 0 {
+		retry = 10
+	}
+
+	var iProject cloudprovider.ICloudProject = nil
+	projectName := project.Name
+	for i := 0; i < retry; i++ {
+		iProject, err = provider.CreateIProject(projectName)
+		if err == nil {
+			break
+		}
+		projectName = fmt.Sprintf("%s-%d", project.Name, i)
+	}
+	if err != nil {
+		if errors.Cause(err) != cloudprovider.ErrNotImplemented && errors.Cause(err) != cloudprovider.ErrNotSupported {
+			logclient.AddSimpleActionLog(self, logclient.ACT_CREATE, err, userCred, false)
+		}
+		return "", errors.Wrapf(err, "CreateIProject(%s)", projectName)
+	}
+
+	extProj, err = ExternalProjectManager.newFromCloudProject(ctx, userCred, self, project, iProject)
+	if err != nil {
+		return "", errors.Wrap(err, "newFromCloudProject")
+	}
+
+	return extProj.ExternalId, nil
+}
--- a/pkg/compute/models/cloudproviderregions.go
+++ b/pkg/compute/models/cloudproviderregions.go
@@ -122,7 +122,7 @@ func (self *SCloudproviderregion) GetAccount() *SCloudaccount {
 func (self *SCloudproviderregion) GetRegion() *SCloudregion {
 	regionObj, err := CloudregionManager.FetchById(self.CloudregionId)
 	if err != nil {
-		log.Errorf("CloudproviderManager.FetchById fail %s", err)
+		log.Errorf("CloudregionManager.FetchById(%s) fail %s", self.CloudregionId, err)
 		return nil
 	}
 	return regionObj.(*SCloudregion)
--- a/pkg/compute/models/cloudproviders.go
+++ b/pkg/compute/models/cloudproviders.go
@@ -1128,7 +1128,8 @@ func (manager *SCloudproviderManager) ListItemFilter(
 			sqlchemy.Equals(vpcs.Field("manager_id"), providers.Field("id")),
 		))
 		if zone != nil {
-			sq = sq.Filter(sqlchemy.Equals(wires.Field("zone_id"), zone.GetId()))
+			zoneFilter := sqlchemy.OR(sqlchemy.Equals(wires.Field("zone_id"), zone.GetId()), sqlchemy.IsNullOrEmpty(wires.Field("zone_id")))
+			sq = sq.Filter(zoneFilter)
 		} else if region != nil {
 			sq = sq.Filter(sqlchemy.Equals(vpcs.Field("cloudregion_id"), region.GetId()))
 		}
@@ -1372,7 +1373,6 @@ func (self *SCloudprovider) RealDelete(ctx context.Context, userCred mcclient.To
 		ElasticipManager,
 		NetworkInterfaceManager,
 		CloudproviderRegionManager,
-		ExternalProjectManager,
 		CloudregionManager,
 		CloudproviderQuotaManager,
 	} {
@@ -1628,51 +1628,10 @@ func (provider *SCloudprovider) GetChangeOwnerCandidateDomainIds() []string {
 	return []string{}
 }

-func (self *SCloudprovider) GetExternalProjects() ([]SExternalProject, error) {
-	q := ExternalProjectManager.Query().Equals("manager_id", self.Id)
-	projects := []SExternalProject{}
-	err := db.FetchModelObjects(ExternalProjectManager, q, &projects)
-	if err != nil {
-		return nil, errors.Wrap(err, "FetchModelObjects")
-	}
-	return projects, nil
-}
-
 func (self *SCloudprovider) SyncProject(ctx context.Context, userCred mcclient.TokenCredential, id string) (string, error) {
-	lockman.LockRawObject(ctx, self.Id, id)
-	defer lockman.ReleaseRawObject(ctx, self.Id, id)
-
-	projects, err := self.GetExternalProjects()
-	if err != nil {
-		return "", errors.Wrap(err, "GetExternalProjects")
+	account := self.GetCloudaccount()
+	if account == nil {
+		return "", fmt.Errorf("failed to get cloudprovider %s account", self.Name)
 	}
-	for _, project := range projects {
-		if project.ProjectId == id {
-			return project.ExternalId, nil
-		}
-	}
-
-	project, err := db.TenantCacheManager.FetchById(id)
-	if err != nil {
-		return "", errors.Wrap(err, "TenantCacheManager.FetchById")
-	}
-
-	for _, extProj := range projects {
-		if extProj.Name == project.GetName() {
-			return extProj.ExternalId, nil
-		}
-	}
-	provider, err := self.GetProvider()
-	if err != nil {
-		return "", errors.Wrap(err, "GetProvider")
-	}
-	iProject, err := provider.CreateIProject(project.GetName())
-	if err != nil {
-		return "", errors.Wrap(err, "CreateIProject")
-	}
-	extProj, err := ExternalProjectManager.newFromCloudProject(ctx, userCred, self, iProject)
-	if err != nil {
-		return "", errors.Wrap(err, "newFromCloudProject")
-	}
-	return extProj.ExternalId, nil
+	return account.SyncProject(ctx, userCred, id)
 }
--- a/pkg/compute/models/cloudregions.go
+++ b/pkg/compute/models/cloudregions.go
@@ -226,15 +226,38 @@ func (self *SCloudregion) getGuestCountInternal(increment bool) (int, error) {
 	return query.CountWithError()
 }

-func (self *SCloudregion) GetVpcCount() (int, error) {
+func (self *SCloudregion) GetVpcQuery() *sqlchemy.SQuery {
 	vpcs := VpcManager.Query()
 	if self.Id == api.DEFAULT_REGION_ID {
 		return vpcs.Filter(sqlchemy.OR(sqlchemy.IsNull(vpcs.Field("cloudregion_id")),
 			sqlchemy.IsEmpty(vpcs.Field("cloudregion_id")),
-			sqlchemy.Equals(vpcs.Field("cloudregion_id"), self.Id))).CountWithError()
-	} else {
-		return vpcs.Equals("cloudregion_id", self.Id).CountWithError()
+			sqlchemy.Equals(vpcs.Field("cloudregion_id"), self.Id)))
 	}
+	return vpcs.Equals("cloudregion_id", self.Id)
+}
+
+func (self *SCloudregion) GetVpcCount() (int, error) {
+	return self.GetVpcQuery().CountWithError()
+}
+
+func (self *SCloudregion) GetVpcs() ([]SVpc, error) {
+	vpcs := []SVpc{}
+	q := self.GetVpcQuery()
+	err := db.FetchModelObjects(VpcManager, q, &vpcs)
+	if err != nil {
+		return nil, errors.Wrap(err, "db.FetchModelObjects")
+	}
+	return vpcs, nil
+}
+
+func (self *SCloudregion) GetCloudproviderVpcs(managerId string) ([]SVpc, error) {
+	vpcs := []SVpc{}
+	q := self.GetVpcQuery().Equals("manager_id", managerId)
+	err := db.FetchModelObjects(VpcManager, q, &vpcs)
+	if err != nil {
+		return nil, errors.Wrap(err, "db.FetchModelObjects")
+	}
+	return vpcs, nil
 }

 func (self *SCloudregion) GetDriver() IRegionDriver {
@@ -497,7 +520,7 @@ func (self *SCloudregion) AllowPerformDefaultVpc(ctx context.Context, userCred m
 }

 func (self *SCloudregion) PerformDefaultVpc(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data jsonutils.JSONObject) (jsonutils.JSONObject, error) {
-	vpcs, err := VpcManager.getVpcsByRegion(self, nil)
+	vpcs, err := self.GetVpcs()
 	if err != nil {
 		return nil, err
 	}
--- a/pkg/compute/models/cloudsync.go
+++ b/pkg/compute/models/cloudsync.go
@@ -172,28 +172,6 @@ func syncRegionSkus(ctx context.Context, userCred mcclient.TokenCredential, loca
 	}
 }

-func syncProjects(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, driver cloudprovider.ICloudProvider, provider *SCloudprovider) {
-	projects, err := driver.GetIProjects()
-	if err != nil {
-		msg := fmt.Sprintf("GetIProjects for provider %s failed %s", provider.GetName(), err)
-		log.Errorf(msg)
-		// logSyncFailed(provider, task, msg)
-		return
-	}
-
-	result := ExternalProjectManager.SyncProjects(ctx, userCred, provider, projects)
-
-	syncResults.Add(ExternalProjectManager, result)
-
-	msg := result.Result()
-	log.Infof("SyncProjects for provider %s result: %s", provider.Name, msg)
-	if result.IsError() {
-		// logSyncFailed(provider, task, msg)
-		return
-	}
-	// db.OpsLog.LogEvent(provider, db.ACT_SYNC_PROJECT_COMPLETE, msg, task.UserCred)
-}
-
 func syncRegionEips(ctx context.Context, userCred mcclient.TokenCredential, syncResults SSyncResultSet, provider *SCloudprovider, localRegion *SCloudregion, remoteRegion cloudprovider.ICloudRegion, syncRange *SSyncRange) {
 	eips, err := remoteRegion.GetIEips()
 	if err != nil {
@@ -658,7 +636,7 @@ func syncHostVMs(ctx context.Context, userCred mcclient.TokenCredential, syncRes
 }

 func syncVMPeripherals(ctx context.Context, userCred mcclient.TokenCredential, local *SGuest, remote cloudprovider.ICloudVM, host *SHost, provider *SCloudprovider, driver cloudprovider.ICloudProvider) {
-	syncMetadata(ctx, userCred, local, remote)
+	syncVirtualResourceMetadata(ctx, userCred, local, remote)
 	err := syncVMNics(ctx, userCred, provider, host, local, remote)
 	if err != nil {
 		log.Errorf("syncVMNics error %s", err)
@@ -1027,10 +1005,6 @@ func syncPublicCloudProviderInfo(

 	storageCachePairs := make([]sStoragecacheSyncPair, 0)

-	if cloudprovider.IsSupportProject(driver) {
-		syncProjects(ctx, userCred, syncResults, driver, provider)
-	}
-
 	syncRegionQuotas(ctx, userCred, syncResults, driver, provider, localRegion, remoteRegion)

 	localZones, remoteZones, _ := syncRegionZones(ctx, userCred, syncResults, provider, localRegion, remoteRegion)
@@ -1124,10 +1098,6 @@ func syncOnPremiseCloudProviderInfo(
 ) error {
 	log.Debugf("Start sync on-premise provider %s(%s)", provider.Name, provider.Provider)

-	if cloudprovider.IsSupportProject(driver) {
-		syncProjects(ctx, userCred, syncResults, driver, provider)
-	}
-
 	iregion, err := driver.GetOnPremiseIRegion()
 	if err != nil {
 		msg := fmt.Sprintf("GetOnPremiseIRegion for provider %s failed %s", provider.GetName(), err)
@@ -1221,7 +1191,7 @@ func SyncCloudProject(userCred mcclient.TokenCredential, model db.IVirtualModel,
 	if extProjectId := extModel.GetProjectId(); len(extProjectId) > 0 {
 		extProject, err := ExternalProjectManager.GetProject(extProjectId, managerId)
 		if err != nil {
-			log.Errorln(err)
+			log.Errorf("sync project for %s %s error: %v", model.Keyword(), model.GetName(), err)
 		} else {
 			newOwnerId = extProject.GetOwnerId()
 		}
--- a/pkg/compute/models/dbinstance_backups.go
+++ b/pkg/compute/models/dbinstance_backups.go
@@ -437,7 +437,9 @@ func (self *SDBInstanceBackup) SyncWithCloudDBInstanceBackup(

 		if dbinstanceId := extBackup.GetDBInstanceId(); len(dbinstanceId) > 0 {
 			//有可能云上删除了实例，未删除备份
-			_instance, err := db.FetchByExternalId(DBInstanceManager, dbinstanceId)
+			_instance, err := db.FetchByExternalIdAndManagerId(DBInstanceManager, dbinstanceId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", provider.Id)
+			})
 			if err == sql.ErrNoRows {
 				self.DBInstanceId = ""
 			}
@@ -493,7 +495,9 @@ func (manager *SDBInstanceBackupManager) newFromCloudDBInstanceBackup(
 	backup.ExternalId = extBackup.GetGlobalId()

 	if dbinstanceId := extBackup.GetDBInstanceId(); len(dbinstanceId) > 0 {
-		_dbinstance, err := db.FetchByExternalId(DBInstanceManager, dbinstanceId)
+		_dbinstance, err := db.FetchByExternalIdAndManagerId(DBInstanceManager, dbinstanceId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			return q.Equals("manager_id", provider.Id)
+		})
 		if err != nil {
 			log.Warningf("failed to found dbinstance for backup %s by externalId: %s error: %v", backup.Name, dbinstanceId, err)
 		} else {
--- a/pkg/compute/models/dbinstancenetworks.go
+++ b/pkg/compute/models/dbinstancenetworks.go
@@ -23,6 +23,7 @@ import (
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/compare"
 	"yunion.io/x/pkg/util/netutils"
+	"yunion.io/x/sqlchemy"

 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
@@ -162,9 +163,15 @@ func (manager *SDBInstanceNetworkManager) SyncDBInstanceNetwork(ctx context.Cont

 func (self *SDBInstanceNetwork) syncWithCloudDBNetwork(ctx context.Context, userCred mcclient.TokenCredential, dbinstance *SDBInstance, network *cloudprovider.SDBInstanceNetwork) error {
 	_, err := db.UpdateWithLock(ctx, self, func() error {
-		_localnetwork, err := db.FetchByExternalId(NetworkManager, network.NetworkId)
+		_localnetwork, err := db.FetchByExternalIdAndManagerId(NetworkManager, network.NetworkId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			wire := WireManager.Query().SubQuery()
+			vpc := VpcManager.Query().SubQuery()
+			return q.Join(wire, sqlchemy.Equals(wire.Field("id"), q.Field("wire_id"))).
+				Join(vpc, sqlchemy.Equals(vpc.Field("id"), wire.Field("vpc_id"))).
+				Filter(sqlchemy.Equals(vpc.Field("manager_id"), dbinstance.ManagerId))
+		})
 		if err != nil {
-			return errors.Wrapf(err, "FetchByExternalId")
+			return errors.Wrapf(err, "FetchByExternalIdAndManagerId")
 		}
 		localnetwork := _localnetwork.(*SNetwork)
 		self.NetworkId = localnetwork.Id
@@ -194,9 +201,15 @@ func (manager *SDBInstanceNetworkManager) newFromCloudDBNetwork(ctx context.Cont
 	dbNetwork.SetModelManager(manager, &dbNetwork)

 	dbNetwork.DBInstanceId = dbinstance.Id
-	_localnetwork, err := db.FetchByExternalId(NetworkManager, network.NetworkId)
+	_localnetwork, err := db.FetchByExternalIdAndManagerId(NetworkManager, network.NetworkId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		wire := WireManager.Query().SubQuery()
+		vpc := VpcManager.Query().SubQuery()
+		return q.Join(wire, sqlchemy.Equals(wire.Field("id"), q.Field("wire_id"))).
+			Join(vpc, sqlchemy.Equals(vpc.Field("id"), wire.Field("vpc_id"))).
+			Filter(sqlchemy.Equals(vpc.Field("manager_id"), dbinstance.ManagerId))
+	})
 	if err != nil {
-		return errors.Wrapf(err, "newFromCloudDBNetwork.FetchByExternalId")
+		return errors.Wrapf(err, "newFromCloudDBNetwork.FetchByExternalIdAndManagerId")
 	}

 	localnetwork := _localnetwork.(*SNetwork)
--- a/pkg/compute/models/dbinstances.go
+++ b/pkg/compute/models/dbinstances.go
@@ -1236,12 +1236,16 @@ func (manager *SDBInstanceManager) SyncDBInstanceMasterId(ctx context.Context, u
 	for _, instance := range cloudDBInstances {
 		masterId := instance.GetMasterInstanceId()
 		if len(masterId) > 0 {
-			master, err := db.FetchByExternalId(manager, masterId)
+			master, err := db.FetchByExternalIdAndManagerId(manager, masterId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", provider.Id)
+			})
 			if err != nil {
 				log.Errorf("failed to found master dbinstance by externalId: %s error: %v", masterId, err)
 				continue
 			}
-			slave, err := db.FetchByExternalId(manager, instance.GetGlobalId())
+			slave, err := db.FetchByExternalIdAndManagerId(manager, instance.GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", provider.Id)
+			})
 			if err != nil {
 				log.Errorf("failed to found local dbinstance by externalId %s error: %v", instance.GetGlobalId(), err)
 				continue
@@ -1296,7 +1300,7 @@ func (manager *SDBInstanceManager) SyncDBInstances(ctx context.Context, userCred
 			syncResult.UpdateError(err)
 			continue
 		}
-		syncMetadata(ctx, userCred, &commondb[i], commonext[i])
+		syncVirtualResourceMetadata(ctx, userCred, &commondb[i], commonext[i])
 		localDBInstances = append(localDBInstances, commondb[i])
 		remoteDBInstances = append(remoteDBInstances, commonext[i])
 		syncResult.Update()
@@ -1308,7 +1312,7 @@ func (manager *SDBInstanceManager) SyncDBInstances(ctx context.Context, userCred
 			syncResult.AddError(err)
 			continue
 		}
-		syncMetadata(ctx, userCred, instance, added[i])
+		syncVirtualResourceMetadata(ctx, userCred, instance, added[i])
 		localDBInstances = append(localDBInstances, *instance)
 		remoteDBInstances = append(remoteDBInstances, added[i])
 		syncResult.Add()
@@ -1495,7 +1499,9 @@ func (self *SDBInstance) SyncWithCloudDBInstance(ctx context.Context, userCred m

 		if len(self.VpcId) == 0 {
 			if vpcId := extInstance.GetIVpcId(); len(vpcId) > 0 {
-				vpc, err := db.FetchByExternalId(VpcManager, vpcId)
+				vpc, err := db.FetchByExternalIdAndManagerId(VpcManager, vpcId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+					return q.Equals("manager_id", provider.Id)
+				})
 				if err != nil {
 					return errors.Wrapf(err, "SyncWithCloudDBInstance.FetchVpcId")
 				}
@@ -1580,7 +1586,9 @@ func (manager *SDBInstanceManager) newFromCloudDBInstance(ctx context.Context, u
 	}

 	if vpcId := extInstance.GetIVpcId(); len(vpcId) > 0 {
-		vpc, err := db.FetchByExternalId(VpcManager, vpcId)
+		vpc, err := db.FetchByExternalIdAndManagerId(VpcManager, vpcId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			return q.Equals("manager_id", provider.Id)
+		})
 		if err != nil {
 			return nil, errors.Wrapf(err, "newFromCloudDBInstance.FetchVpcId")
 		}
--- a/pkg/compute/models/disks.go
+++ b/pkg/compute/models/disks.go
@@ -1138,6 +1138,14 @@ func (self *SDisk) IsLocal() bool {
 	return false
 }

+func (self *SDisk) GetCloudproviderId() string {
+	storage := self.GetStorage()
+	if storage != nil {
+		return storage.GetCloudproviderId()
+	}
+	return ""
+}
+
 func (self *SDisk) GetStorage() *SStorage {
 	store, _ := StorageManager.FetchById(self.StorageId)
 	if store != nil {
@@ -1209,13 +1217,16 @@ func (manager *SDiskManager) getDisksByStorage(storage *SStorage) ([]SDisk, erro
 	return disks, nil
 }

-func (manager *SDiskManager) syncCloudDisk(ctx context.Context, userCred mcclient.TokenCredential, provider cloudprovider.ICloudProvider, vdisk cloudprovider.ICloudDisk, index int, syncOwnerId mcclient.IIdentityProvider) (*SDisk, error) {
+func (manager *SDiskManager) syncCloudDisk(ctx context.Context, userCred mcclient.TokenCredential, provider cloudprovider.ICloudProvider, vdisk cloudprovider.ICloudDisk, index int, syncOwnerId mcclient.IIdentityProvider, managerId string) (*SDisk, error) {
 	// ownerProjId := projectId

 	lockman.LockClass(ctx, manager, db.GetLockClassKey(manager, syncOwnerId))
 	defer lockman.ReleaseClass(ctx, manager, db.GetLockClassKey(manager, syncOwnerId))

-	diskObj, err := db.FetchByExternalId(manager, vdisk.GetGlobalId())
+	diskObj, err := db.FetchByExternalIdAndManagerId(manager, vdisk.GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		sq := StorageManager.Query().SubQuery()
+		return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("storage_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), managerId))
+	})
 	if err != nil {
 		if err == sql.ErrNoRows {
 			vstorage, err := vdisk.GetIStorage()
@@ -1223,7 +1234,9 @@ func (manager *SDiskManager) syncCloudDisk(ctx context.Context, userCred mcclien
 				return nil, errors.Wrapf(err, "unable to GetIStorage of vdisk %q", vdisk.GetName())
 			}

-			storageObj, err := db.FetchByExternalId(StorageManager, vstorage.GetGlobalId())
+			storageObj, err := db.FetchByExternalIdAndManagerId(StorageManager, vstorage.GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", managerId)
+			})
 			if err != nil {
 				log.Errorf("cannot find storage of vdisk %s", err)
 				return nil, err
@@ -1235,7 +1248,7 @@ func (manager *SDiskManager) syncCloudDisk(ctx context.Context, userCred mcclien
 		}
 	} else {
 		disk := diskObj.(*SDisk)
-		err = disk.syncWithCloudDisk(ctx, userCred, provider, vdisk, index, syncOwnerId)
+		err = disk.syncWithCloudDisk(ctx, userCred, provider, vdisk, index, syncOwnerId, managerId)
 		if err != nil {
 			return nil, err
 		}
@@ -1280,11 +1293,11 @@ func (manager *SDiskManager) SyncDisks(ctx context.Context, userCred mcclient.To
 	}

 	for i := 0; i < len(commondb); i += 1 {
-		err = commondb[i].syncWithCloudDisk(ctx, userCred, provider, commonext[i], -1, syncOwnerId)
+		err = commondb[i].syncWithCloudDisk(ctx, userCred, provider, commonext[i], -1, syncOwnerId, storage.ManagerId)
 		if err != nil {
 			syncResult.UpdateError(err)
 		} else {
-			syncMetadata(ctx, userCred, &commondb[i], commonext[i])
+			syncVirtualResourceMetadata(ctx, userCred, &commondb[i], commonext[i])
 			localDisks = append(localDisks, commondb[i])
 			remoteDisks = append(remoteDisks, commonext[i])
 			syncResult.Update()
@@ -1293,7 +1306,10 @@ func (manager *SDiskManager) SyncDisks(ctx context.Context, userCred mcclient.To

 	for i := 0; i < len(added); i += 1 {
 		extId := added[i].GetGlobalId()
-		_disk, err := db.FetchByExternalId(manager, extId)
+		_disk, err := db.FetchByExternalIdAndManagerId(manager, extId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			sq := StorageManager.Query().SubQuery()
+			return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("storage_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), storage.ManagerId))
+		})
 		if err != nil && err != sql.ErrNoRows {
 			//主要是显示duplicate err及 general err,方便排错
 			msg := fmt.Errorf("failed to found disk by external Id %s error: %v", extId, err)
@@ -1302,7 +1318,7 @@ func (manager *SDiskManager) SyncDisks(ctx context.Context, userCred mcclient.To
 		}
 		if _disk != nil {
 			disk := _disk.(*SDisk)
-			err = disk.syncDiskStorage(ctx, userCred, added[i])
+			err = disk.syncDiskStorage(ctx, userCred, added[i], storage.ManagerId)
 			if err != nil {
 				syncResult.UpdateError(err)
 			} else {
@@ -1314,7 +1330,7 @@ func (manager *SDiskManager) SyncDisks(ctx context.Context, userCred mcclient.To
 		if err != nil {
 			syncResult.AddError(err)
 		} else {
-			syncMetadata(ctx, userCred, new, added[i])
+			syncVirtualResourceMetadata(ctx, userCred, new, added[i])
 			localDisks = append(localDisks, *new)
 			remoteDisks = append(remoteDisks, added[i])
 			syncResult.Add()
@@ -1324,7 +1340,7 @@ func (manager *SDiskManager) SyncDisks(ctx context.Context, userCred mcclient.To
 	return localDisks, remoteDisks, syncResult
 }

-func (self *SDisk) syncDiskStorage(ctx context.Context, userCred mcclient.TokenCredential, idisk cloudprovider.ICloudDisk) error {
+func (self *SDisk) syncDiskStorage(ctx context.Context, userCred mcclient.TokenCredential, idisk cloudprovider.ICloudDisk, managerId string) error {
 	extId := idisk.GetGlobalId()
 	istorage, err := idisk.GetIStorage()
 	if err != nil {
@@ -1332,7 +1348,9 @@ func (self *SDisk) syncDiskStorage(ctx context.Context, userCred mcclient.TokenC
 		return err
 	}
 	storageExtId := istorage.GetGlobalId()
-	storage, err := db.FetchByExternalId(StorageManager, storageExtId)
+	storage, err := db.FetchByExternalIdAndManagerId(StorageManager, storageExtId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		return q.Equals("manager_id", managerId)
+	})
 	if err != nil {
 		log.Errorf("failed to found storage by istorage %s error: %v", storageExtId, err)
 		return err
@@ -1384,7 +1402,12 @@ func (self *SDisk) syncRemoveCloudDisk(ctx context.Context, userCred mcclient.To
 	iDisk, err := iregion.GetIDiskById(self.ExternalId)
 	if err == nil {
 		if storageId := iDisk.GetIStorageId(); len(storageId) > 0 {
-			storage, err := db.FetchByExternalId(StorageManager, storageId)
+			storage, err := db.FetchByExternalIdAndManagerId(StorageManager, storageId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				if s := self.GetStorage(); s != nil {
+					return q.Equals("manager_id", s.ManagerId)
+				}
+				return q
+			})
 			if err == nil {
 				_, err = db.Update(self, func() error {
 					self.StorageId = storage.GetId()
@@ -1410,7 +1433,7 @@ func (self *SDisk) syncRemoveCloudDisk(ctx context.Context, userCred mcclient.To
 	return self.RealDelete(ctx, userCred)
 }

-func (self *SDisk) syncWithCloudDisk(ctx context.Context, userCred mcclient.TokenCredential, provider cloudprovider.ICloudProvider, extDisk cloudprovider.ICloudDisk, index int, syncOwnerId mcclient.IIdentityProvider) error {
+func (self *SDisk) syncWithCloudDisk(ctx context.Context, userCred mcclient.TokenCredential, provider cloudprovider.ICloudProvider, extDisk cloudprovider.ICloudDisk, index int, syncOwnerId mcclient.IIdentityProvider, managerId string) error {
 	recycle := false
 	guests := self.GetGuests()
 	if provider.GetFactory().IsSupportPrepaidResources() && len(guests) == 1 && guests[0].IsPrepaidRecycle() {
--- a/pkg/compute/models/elasticcache_instances.go
+++ b/pkg/compute/models/elasticcache_instances.go
@@ -472,7 +472,7 @@ func (manager *SElasticcacheManager) SyncElasticcaches(ctx context.Context, user
 			syncResult.UpdateError(err)
 			continue
 		}
-		syncMetadata(ctx, userCred, &commondb[i], commonext[i])
+		syncVirtualResourceMetadata(ctx, userCred, &commondb[i], commonext[i])
 		localElasticcaches = append(localElasticcaches, commondb[i])
 		remoteElasticcaches = append(remoteElasticcaches, commonext[i])
 		syncResult.Update()
@@ -484,7 +484,7 @@ func (manager *SElasticcacheManager) SyncElasticcaches(ctx context.Context, user
 			syncResult.AddError(err)
 			continue
 		}
-		syncMetadata(ctx, userCred, instance, added[i])
+		syncVirtualResourceMetadata(ctx, userCred, instance, added[i])
 		localElasticcaches = append(localElasticcaches, *instance)
 		remoteElasticcaches = append(remoteElasticcaches, added[i])
 		syncResult.Add()
@@ -562,7 +562,6 @@ func (manager *SElasticcacheManager) newFromCloudElasticcache(ctx context.Contex
 	instance.Engine = extInstance.GetEngine()
 	instance.EngineVersion = extInstance.GetEngineVersion()

-	instance.NetworkType = extInstance.GetNetworkType()
 	instance.PrivateDNS = extInstance.GetPrivateDNS()
 	instance.PrivateIpAddr = extInstance.GetPrivateIpAddr()
 	instance.PrivateConnectPort = extInstance.GetPrivateConnectPort()
@@ -573,28 +572,57 @@ func (manager *SElasticcacheManager) newFromCloudElasticcache(ctx context.Contex
 	instance.MaintainEndTime = extInstance.GetMaintainEndTime()
 	instance.AuthMode = extInstance.GetAuthMode()

+	var zone *SZone
 	if zoneId := extInstance.GetZoneId(); len(zoneId) > 0 {
-		zone, err := db.FetchByExternalId(ZoneManager, zoneId)
+		_zone, err := db.FetchByExternalId(ZoneManager, zoneId)
 		if err != nil {
 			return nil, errors.Wrapf(err, "newFromCloudElasticcache.FetchZoneId")
 		}
-		instance.ZoneId = zone.GetId()
+		instance.ZoneId = _zone.GetId()
+		zone = _zone.(*SZone)
 	}

-	if vpcId := extInstance.GetVpcId(); len(vpcId) > 0 {
-		vpc, err := db.FetchByExternalId(VpcManager, vpcId)
+	instance.NetworkType = extInstance.GetNetworkType()
+	if instance.NetworkType == api.LB_NETWORK_TYPE_CLASSIC {
+		vpc, err := VpcManager.GetOrCreateVpcForClassicNetwork(region)
 		if err != nil {
-			return nil, errors.Wrapf(err, "newFromCloudElasticcache.FetchVpcId")
+			return nil, errors.Wrap(err, "NewVpcForClassicNetwork")
 		}
 		instance.VpcId = vpc.GetId()
-	}

-	if networkId := extInstance.GetNetworkId(); len(networkId) > 0 {
-		network, err := db.FetchByExternalId(NetworkManager, networkId)
+		wire, err := WireManager.GetOrCreateWireForClassicNetwork(vpc, zone)
 		if err != nil {
-			return nil, errors.Wrapf(err, "newFromCloudElasticcache.FetchNetworkId")
+			return nil, errors.Wrap(err, "NewWireForClassicNetwork")
+		}
+		network, err := NetworkManager.GetOrCreateClassicNetwork(wire)
+		if err != nil {
+			return nil, errors.Wrap(err, "GetOrCreateClassicNetwork")
 		}
 		instance.NetworkId = network.GetId()
+	} else {
+		if vpcId := extInstance.GetVpcId(); len(vpcId) > 0 {
+			vpc, err := db.FetchByExternalIdAndManagerId(VpcManager, vpcId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", provider.Id)
+			})
+			if err != nil {
+				return nil, errors.Wrapf(err, "newFromCloudElasticcache.FetchVpcId")
+			}
+			instance.VpcId = vpc.GetId()
+		}
+
+		if networkId := extInstance.GetNetworkId(); len(networkId) > 0 {
+			network, err := db.FetchByExternalIdAndManagerId(NetworkManager, networkId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				wire := WireManager.Query().SubQuery()
+				vpc := VpcManager.Query().SubQuery()
+				return q.Join(wire, sqlchemy.Equals(wire.Field("id"), q.Field("wire_id"))).
+					Join(vpc, sqlchemy.Equals(vpc.Field("id"), wire.Field("vpc_id"))).
+					Filter(sqlchemy.Equals(vpc.Field("manager_id"), provider.Id))
+			})
+			if err != nil {
+				return nil, errors.Wrapf(err, "newFromCloudElasticcache.FetchNetworkId")
+			}
+			instance.NetworkId = network.GetId()
+		}
 	}

 	if createdAt := extInstance.GetCreatedAt(); !createdAt.IsZero() {
--- a/pkg/compute/models/elasticcache_skus.go
+++ b/pkg/compute/models/elasticcache_skus.go
@@ -448,6 +448,8 @@ func (self *SElasticcacheSku) syncWithCloudSku(ctx context.Context, userCred mcc
 	_, err := db.Update(self, func() error {
 		self.PrepaidStatus = extSku.PrepaidStatus
 		self.PostpaidStatus = extSku.PostpaidStatus
+		self.ZoneId = extSku.ZoneId
+		self.SlaveZoneId = extSku.SlaveZoneId
 		return nil
 	})
 	return err
--- a/pkg/compute/models/elasticips.go
+++ b/pkg/compute/models/elasticips.go
@@ -156,6 +156,8 @@ func (manager *SElasticipManager) ListItemFilter(
 				sq := networks.Query(networks.Field("id")).Join(wires, sqlchemy.Equals(wires.Field("id"), networks.Field("wire_id"))).
 					Filter(sqlchemy.Equals(wires.Field("zone_id"), zone.Id)).SubQuery()
 				q = q.Filter(sqlchemy.In(q.Field("network_id"), sq))
+				gns := GuestnetworkManager.Query("network_id").Equals("guest_id", guest.Id).SubQuery()
+				q = q.Filter(sqlchemy.NotIn(q.Field("network_id"), gns))
 			} else {
 				region := guest.getRegion()
 				q = q.Equals("cloudregion_id", region.Id)
@@ -358,7 +360,7 @@ func (manager *SElasticipManager) SyncEips(ctx context.Context, userCred mcclien
 		if err != nil {
 			syncResult.UpdateError(err)
 		} else {
-			syncMetadata(ctx, userCred, &commondb[i], commonext[i])
+			syncVirtualResourceMetadata(ctx, userCred, &commondb[i], commonext[i])
 			syncResult.Update()
 		}
 	}
@@ -367,7 +369,7 @@ func (manager *SElasticipManager) SyncEips(ctx context.Context, userCred mcclien
 		if err != nil {
 			syncResult.AddError(err)
 		} else {
-			syncMetadata(ctx, userCred, new, added[i])
+			syncVirtualResourceMetadata(ctx, userCred, new, added[i])
 			syncResult.Add()
 		}
 	}
@@ -414,7 +416,16 @@ func (self *SElasticip) SyncInstanceWithCloudEip(ctx context.Context, userCred m
 			return errors.Error("unsupported association type")
 		}

-		extRes, err := db.FetchByExternalId(manager, vmExtId)
+		extRes, err := db.FetchByExternalIdAndManagerId(manager, vmExtId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			switch ext.GetAssociationType() {
+			case api.EIP_ASSOCIATE_TYPE_SERVER:
+				sq := HostManager.Query().SubQuery()
+				return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("host_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), self.ManagerId))
+			case api.EIP_ASSOCIATE_TYPE_NAT_GATEWAY, api.EIP_ASSOCIATE_TYPE_LOADBALANCER:
+				return q.Equals("manager_id", self.ManagerId)
+			}
+			return q
+		})
 		if err != nil {
 			log.Errorf("fail to find vm by external ID %s", vmExtId)
 			return err
@@ -501,7 +512,13 @@ func (manager *SElasticipManager) newFromCloudEip(ctx context.Context, userCred
 	eip.CloudregionId = region.Id
 	eip.ChargeType = extEip.GetInternetChargeType()
 	if networkId := extEip.GetINetworkId(); len(networkId) > 0 {
-		network, err := db.FetchByExternalId(NetworkManager, networkId)
+		network, err := db.FetchByExternalIdAndManagerId(NetworkManager, networkId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			wire := WireManager.Query().SubQuery()
+			vpc := VpcManager.Query().SubQuery()
+			return q.Join(wire, sqlchemy.Equals(wire.Field("id"), q.Field("wire_id"))).
+				Join(vpc, sqlchemy.Equals(vpc.Field("id"), wire.Field("vpc_id"))).
+				Filter(sqlchemy.Equals(vpc.Field("manager_id"), provider.Id))
+		})
 		if err != nil {
 			msg := fmt.Sprintf("failed to found network by externalId %s error: %v", networkId, err)
 			log.Errorf(msg)
@@ -759,7 +776,9 @@ func (self *SElasticip) AssociateNatGateway(ctx context.Context, userCred mcclie
 }

 func (manager *SElasticipManager) getEipByExtEip(ctx context.Context, userCred mcclient.TokenCredential, extEip cloudprovider.ICloudEIP, provider *SCloudprovider, region *SCloudregion, syncOwnerId mcclient.IIdentityProvider) (*SElasticip, error) {
-	eipObj, err := db.FetchByExternalId(manager, extEip.GetGlobalId())
+	eipObj, err := db.FetchByExternalIdAndManagerId(manager, extEip.GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		return q.Equals("manager_id", provider.Id)
+	})
 	if err == nil {
 		return eipObj.(*SElasticip), nil
 	}
--- a/pkg/compute/models/external_projects.go
+++ b/pkg/compute/models/external_projects.go
@@ -16,6 +16,7 @@ package models

 import (
 	"context"
+	"database/sql"
 	"fmt"

 	"yunion.io/x/jsonutils"
@@ -35,8 +36,7 @@ import (
 )

 type SExternalProjectManager struct {
-	db.SStandaloneResourceBaseManager
-	db.SProjectizedResourceBaseManager
+	db.SVirtualResourceBaseManager
 	db.SExternalizedResourceBaseManager
 	SManagedResourceBaseManager
 }
@@ -45,7 +45,7 @@ var ExternalProjectManager *SExternalProjectManager

 func init() {
 	ExternalProjectManager = &SExternalProjectManager{
-		SStandaloneResourceBaseManager: db.NewStandaloneResourceBaseManager(
+		SVirtualResourceBaseManager: db.NewVirtualResourceBaseManager(
 			SExternalProject{},
 			"externalprojects_tbl",
 			"externalproject",
@@ -56,34 +56,22 @@ func init() {
 }

 type SExternalProject struct {
-	db.SStandaloneResourceBase
-	db.SProjectizedResourceBase
+	db.SVirtualResourceBase
 	db.SExternalizedResourceBase
 	SManagedResourceBase
+
+	// 归属云账号ID
+	CloudaccountId string `width:"36" charset:"ascii" nullable:"false" list:"user"`
 }

 func (manager *SExternalProjectManager) AllowListItems(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject) bool {
-	return db.IsAdminAllowList(userCred, manager)
+	return db.IsDomainAllowList(userCred, manager)
 }

 func (self *SExternalProject) AllowUpdateItem(ctx context.Context, userCred mcclient.TokenCredential) bool {
 	return false
 }

-func (manager *SExternalProjectManager) getProjectsByProviderId(providerId string) ([]SExternalProject, error) {
-	projects := []SExternalProject{}
-	err := fetchByManagerId(manager, providerId, &projects)
-	if err != nil {
-		return nil, err
-	}
-	return projects, nil
-}
-
-func (self *SExternalProject) getCloudProviderInfo() SCloudProviderInfo {
-	provider := self.GetCloudprovider()
-	return MakeCloudProviderInfo(nil, nil, provider)
-}
-
 func (self *SExternalProject) GetExtraDetails(
 	ctx context.Context,
 	userCred mcclient.TokenCredential,
@@ -102,16 +90,28 @@ func (manager *SExternalProjectManager) FetchCustomizeColumns(
 	isList bool,
 ) []api.ExternalProjectDetails {
 	rows := make([]api.ExternalProjectDetails, len(objs))
-
-	stdRows := manager.SStandaloneResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
-	manRows := manager.SManagedResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
-	projRows := manager.SProjectizedResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
-
+	virRows := manager.SVirtualResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
+	accountIds := make([]string, len(objs))
 	for i := range rows {
 		rows[i] = api.ExternalProjectDetails{
-			StandaloneResourceDetails: stdRows[i],
-			ManagedResourceInfo:       manRows[i],
-			ProjectizedResourceInfo:   projRows[i],
+			VirtualResourceDetails: virRows[i],
+		}
+		proj := objs[i].(*SExternalProject)
+		accountIds[i] = proj.CloudaccountId
+	}
+	accounts := make(map[string]SCloudaccount)
+	err := db.FetchStandaloneObjectsByIds(CloudaccountManager, accountIds, &accounts)
+	if err != nil {
+		log.Errorf("FetchStandaloneObjectsByIds (%s) fail %s",
+			CloudaccountManager.KeywordPlural(), err)
+		return rows
+	}
+
+	for i := range rows {
+		if account, ok := accounts[accountIds[i]]; ok {
+			rows[i].Account = account.Name
+			rows[i].Brand = account.Brand
+			rows[i].Provider = account.Provider
 		}
 	}

@@ -121,7 +121,8 @@ func (manager *SExternalProjectManager) FetchCustomizeColumns(
 func (manager *SExternalProjectManager) GetProject(externalId string, providerId string) (*SExternalProject, error) {
 	project := &SExternalProject{}
 	project.SetModelManager(manager, project)
-	q := manager.Query().Equals("external_id", externalId).Equals("manager_id", providerId)
+	sq := CloudproviderManager.Query("cloudaccount_id").Equals("id", providerId)
+	q := manager.Query().Equals("external_id", externalId).Equals("cloudaccount_id", sq.SubQuery())
 	count, err := q.CountWithError()
 	if err != nil {
 		return nil, err
@@ -135,13 +136,13 @@ func (manager *SExternalProjectManager) GetProject(externalId string, providerId
 	return project, q.First(project)
 }

-func (manager *SExternalProjectManager) SyncProjects(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, projects []cloudprovider.ICloudProject) compare.SyncResult {
+func (manager *SExternalProjectManager) SyncProjects(ctx context.Context, userCred mcclient.TokenCredential, account *SCloudaccount, projects []cloudprovider.ICloudProject) compare.SyncResult {
 	lockman.LockClass(ctx, manager, db.GetLockClassKey(manager, userCred))
 	defer lockman.ReleaseClass(ctx, manager, db.GetLockClassKey(manager, userCred))

 	syncResult := compare.SyncResult{}

-	dbProjects, err := manager.getProjectsByProviderId(provider.Id)
+	dbProjects, err := account.GetExternalProjects()
 	if err != nil {
 		syncResult.Error(err)
 		return syncResult
@@ -167,7 +168,7 @@ func (manager *SExternalProjectManager) SyncProjects(ctx context.Context, userCr
 		}
 	}
 	for i := 0; i < len(commondb); i++ {
-		err = commondb[i].SyncWithCloudProject(ctx, userCred, provider, commonext[i])
+		err = commondb[i].SyncWithCloudProject(ctx, userCred, account, commonext[i])
 		if err != nil {
 			syncResult.UpdateError(err)
 		} else {
@@ -175,7 +176,7 @@ func (manager *SExternalProjectManager) SyncProjects(ctx context.Context, userCr
 		}
 	}
 	for i := 0; i < len(added); i++ {
-		_, err := manager.newFromCloudProject(ctx, userCred, provider, added[i])
+		_, err := manager.newFromCloudProject(ctx, userCred, account, nil, added[i])
 		if err != nil {
 			syncResult.AddError(err)
 		} else {
@@ -192,13 +193,14 @@ func (self *SExternalProject) syncRemoveCloudProject(ctx context.Context, userCr
 	return self.Delete(ctx, userCred)
 }

-func (self *SExternalProject) SyncWithCloudProject(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, ext cloudprovider.ICloudProject) error {
+func (self *SExternalProject) SyncWithCloudProject(ctx context.Context, userCred mcclient.TokenCredential, account *SCloudaccount, ext cloudprovider.ICloudProject) error {
 	diff, err := db.UpdateWithLock(ctx, self, func() error {
 		self.Name = ext.GetName()
 		self.IsEmulated = ext.IsEmulated()
-		if self.DomainId != provider.DomainId {
-			self.ProjectId = provider.ProjectId
-			self.DomainId = provider.DomainId
+		self.Status = ext.GetStatus()
+		if self.DomainId != account.DomainId {
+			self.ProjectId = account.ProjectId
+			self.DomainId = account.DomainId
 		}
 		return nil
 	})
@@ -210,20 +212,23 @@ func (self *SExternalProject) SyncWithCloudProject(ctx context.Context, userCred
 	return nil
 }

-func (manager *SExternalProjectManager) newFromCloudProject(ctx context.Context, userCred mcclient.TokenCredential, provider *SCloudprovider, extProject cloudprovider.ICloudProject) (*SExternalProject, error) {
+func (manager *SExternalProjectManager) newFromCloudProject(ctx context.Context, userCred mcclient.TokenCredential, account *SCloudaccount, localProject *db.STenant, extProject cloudprovider.ICloudProject) (*SExternalProject, error) {
 	project := SExternalProject{}
 	project.SetModelManager(manager, &project)

 	project.Name = extProject.GetName()
+	project.Status = extProject.GetStatus()
 	project.ExternalId = extProject.GetGlobalId()
 	project.IsEmulated = extProject.IsEmulated()
-	project.ManagerId = provider.Id
-	project.DomainId = provider.DomainId
-	project.ProjectId = provider.ProjectId
-	account := provider.GetCloudaccount()
-	if account != nil && account.AutoCreateProject {
+	project.CloudaccountId = account.Id
+	project.DomainId = account.DomainId
+	project.ProjectId = account.ProjectId
+	if localProject != nil {
+		project.DomainId = localProject.DomainId
+		project.ProjectId = localProject.Id
+	} else if account.AutoCreateProject {
 		desc := fmt.Sprintf("auto create from cloud project %s (%s)", project.Name, project.ExternalId)
-		domainId, projectId, err := getOrCreateTenant(ctx, project.Name, provider.DomainId, "", desc)
+		domainId, projectId, err := getOrCreateTenant(ctx, project.Name, account.DomainId, "", desc)
 		if err != nil {
 			log.Errorf("failed to get or create tenant %s(%s) %v", project.Name, project.ExternalId, err)
 		} else {
@@ -303,21 +308,36 @@ func (manager *SExternalProjectManager) ListItemFilter(
 ) (*sqlchemy.SQuery, error) {
 	var err error

-	q, err = manager.SStandaloneResourceBaseManager.ListItemFilter(ctx, q, userCred, query.StandaloneResourceListInput)
+	q, err = manager.SVirtualResourceBaseManager.ListItemFilter(ctx, q, userCred, query.VirtualResourceListInput)
 	if err != nil {
-		return nil, errors.Wrap(err, "SStandaloneResourceBaseManager.ListItemFilter")
+		return nil, errors.Wrap(err, "SVirtualResourceBaseManager.ListItemFilter")
 	}
 	q, err = manager.SExternalizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ExternalizedResourceBaseListInput)
 	if err != nil {
 		return nil, errors.Wrap(err, "SExternalizedResourceBaseManager.ListItemFilter")
 	}
-	q, err = manager.SManagedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ManagedResourceListInput)
-	if err != nil {
-		return nil, errors.Wrap(err, "SManagedResourceBaseManager.ListItemFilter")
+
+	if len(query.Cloudprovider) > 0 {
+		p, err := CloudproviderManager.FetchByIdOrName(userCred, query.Cloudprovider)
+		if err != nil {
+			if errors.Cause(err) == sql.ErrNoRows {
+				return nil, httperrors.NewResourceNotFoundError2("cloudprovider", query.Cloudprovider)
+			}
+			return nil, httperrors.NewGeneralError(err)
+		}
+		provider := p.(*SCloudprovider)
+		query.Cloudaccount = provider.CloudaccountId
 	}
-	q, err = manager.SProjectizedResourceBaseManager.ListItemFilter(ctx, q, userCred, query.ProjectizedResourceListInput)
-	if err != nil {
-		return nil, errors.Wrap(err, "SProjectizedResourceBaseManager.ListItemFilter")
+
+	if len(query.Cloudaccount) > 0 {
+		account, err := CloudaccountManager.FetchByIdOrName(userCred, query.Cloudaccount)
+		if err != nil {
+			if errors.Cause(err) == sql.ErrNoRows {
+				return nil, httperrors.NewResourceNotFoundError2("cloudaccount", query.Cloudaccount)
+			}
+			return nil, httperrors.NewGeneralError(err)
+		}
+		q = q.Equals("cloudaccount_id", account.GetId())
 	}

 	return q, nil
@@ -331,18 +351,14 @@ func (manager *SExternalProjectManager) OrderByExtraFields(
 ) (*sqlchemy.SQuery, error) {
 	var err error

-	q, err = manager.SStandaloneResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.StandaloneResourceListInput)
+	q, err = manager.SVirtualResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.VirtualResourceListInput)
 	if err != nil {
-		return nil, errors.Wrap(err, "SStandaloneResourceBaseManager.OrderByExtraFields")
+		return nil, errors.Wrap(err, "SVirtualResourceBaseManager.OrderByExtraFields")
 	}
 	q, err = manager.SManagedResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.ManagedResourceListInput)
 	if err != nil {
 		return nil, errors.Wrap(err, "SManagedResourceBaseManager.OrderByExtraFields")
 	}
-	q, err = manager.SProjectizedResourceBaseManager.OrderByExtraFields(ctx, q, userCred, query.ProjectizedResourceListInput)
-	if err != nil {
-		return nil, errors.Wrap(err, "SProjectizedResourceBaseManager.OrderByExtraFields")
-	}

 	return q, nil
 }
@@ -350,7 +366,7 @@ func (manager *SExternalProjectManager) OrderByExtraFields(
 func (manager *SExternalProjectManager) QueryDistinctExtraField(q *sqlchemy.SQuery, field string) (*sqlchemy.SQuery, error) {
 	var err error

-	q, err = manager.SStandaloneResourceBaseManager.QueryDistinctExtraField(q, field)
+	q, err = manager.SVirtualResourceBaseManager.QueryDistinctExtraField(q, field)
 	if err == nil {
 		return q, nil
 	}
@@ -358,23 +374,35 @@ func (manager *SExternalProjectManager) QueryDistinctExtraField(q *sqlchemy.SQue
 	if err == nil {
 		return q, nil
 	}
-	q, err = manager.SProjectizedResourceBaseManager.QueryDistinctExtraField(q, field)
-	if err == nil {
-		return q, nil
-	}

 	return q, httperrors.ErrNotFound
 }

 func (manager *SExternalProjectManager) ListItemExportKeys(ctx context.Context, q *sqlchemy.SQuery, userCred mcclient.TokenCredential,
 	keys stringutils2.SSortedStrings) (*sqlchemy.SQuery, error) {
-	q, err := manager.SStandaloneResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys)
+	q, err := manager.SVirtualResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys)
 	if err != nil {
-		return nil, errors.Wrap(err, "SStandaloneResourceBaseManager.ListItemExportKeys")
-	}
-	q, err = manager.SProjectizedResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys)
-	if err != nil {
-		return nil, errors.Wrap(err, "SProjectizedResourceBaseManager.ListItemExportKeys")
+		return nil, errors.Wrap(err, "SVirtualResourceBaseManager.ListItemExportKeys")
 	}
 	return q, nil
 }
+
+func (manager *SExternalProjectManager) InitializeData() error {
+	eps := []SExternalProject{}
+	q := manager.Query().IsNullOrEmpty("cloudaccount_id")
+	err := db.FetchModelObjects(manager, q, &eps)
+	if err != nil {
+		return err
+	}
+	for i := range eps {
+		_, err = db.Update(&eps[i], func() error {
+			provider := eps[i].GetCloudprovider()
+			if provider == nil {
+				return fmt.Errorf("failed to get external project %s cloudprovider", eps[i].Id)
+			}
+			eps[i].CloudaccountId = provider.CloudaccountId
+			return nil
+		})
+	}
+	return nil
+}
--- a/pkg/compute/models/guest_actions.go
+++ b/pkg/compute/models/guest_actions.go
@@ -985,8 +985,11 @@ func (self *SGuest) StartInsertIsoTask(ctx context.Context, imageId string, boot
 	if boot {
 		data.Add(jsonutils.JSONTrue, "boot")
 	}
-
-	task, err := taskman.TaskManager.NewTask(ctx, "GuestInsertIsoTask", self, userCred, data, parentTaskId, "", nil)
+	taskName := "GuestInsertIsoTask"
+	if self.BackupHostId != "" {
+		taskName = "HaGuestInsertIsoTask"
+	}
+	task, err := taskman.TaskManager.NewTask(ctx, taskName, self, userCred, data, parentTaskId, "", nil)
 	if err != nil {
 		return err
 	}
@@ -1349,6 +1352,10 @@ func (self *SGuest) PerformRebuildRoot(ctx context.Context, userCred mcclient.To
 		if err != nil {
 			return nil, httperrors.NewNotFoundError("failed to find %s", imageId)
 		}
+		err = self.GetDriver().ValidateImage(ctx, img)
+		if err != nil {
+			return nil, err
+		}
 		diskCat := self.CategorizeDisks()
 		if img.MinDiskMB == 0 || img.Status != imageapi.IMAGE_STATUS_ACTIVE {
 			return nil, httperrors.NewInputParameterError("invlid image")
--- a/pkg/compute/models/guestdrivers.go
+++ b/pkg/compute/models/guestdrivers.go
@@ -58,6 +58,7 @@ type IGuestDriver interface {

 	GetJsonDescAtHost(ctx context.Context, userCred mcclient.TokenCredential, guest *SGuest, host *SHost) jsonutils.JSONObject

+	ValidateImage(ctx context.Context, image *cloudprovider.SImage) error
 	ValidateCreateData(ctx context.Context, userCred mcclient.TokenCredential, data *api.ServerCreateInput) (*api.ServerCreateInput, error)

 	ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error)
--- a/pkg/compute/models/guests.go
+++ b/pkg/compute/models/guests.go
@@ -243,18 +243,14 @@ func (manager *SGuestManager) ListItemFilter(
 		q = q.In("host_id", subq.SubQuery())
 	}

-	hostFilter := query.Host
+	hostFilter := query.GetAllGuestsOnHost
 	if len(hostFilter) > 0 {
 		host, _ := HostManager.FetchByIdOrName(nil, hostFilter)
 		if host == nil {
 			return nil, httperrors.NewResourceNotFoundError("host %s not found", hostFilter)
 		}
-		if query.GetBackupGuestsOnHost != nil && *query.GetBackupGuestsOnHost {
-			q.Filter(sqlchemy.OR(sqlchemy.Equals(q.Field("host_id"), host.GetId()),
-				sqlchemy.Equals(q.Field("backup_host_id"), host.GetId())))
-		} else {
-			q = q.Equals("host_id", host.GetId())
-		}
+		q.Filter(sqlchemy.OR(sqlchemy.Equals(q.Field("host_id"), host.GetId()),
+			sqlchemy.Equals(q.Field("backup_host_id"), host.GetId())))
 	}

 	secgrpFilter := query.Secgroup
@@ -771,6 +767,14 @@ func (guest *SGuest) CustomizeCreate(ctx context.Context, userCred mcclient.Toke
 	return guest.SVirtualResourceBase.CustomizeCreate(ctx, userCred, ownerId, query, data)
 }

+func (guest *SGuest) GetCloudproviderId() string {
+	host := guest.GetHost()
+	if host != nil {
+		return host.GetCloudproviderId()
+	}
+	return ""
+}
+
 func (guest *SGuest) GetHost() *SHost {
 	if len(guest.HostId) > 0 && regutils.MatchUUID(guest.HostId) {
 		host, _ := HostManager.FetchById(guest.HostId)
@@ -2284,7 +2288,13 @@ func (self *SGuest) syncRemoveCloudVM(ctx context.Context, userCred mcclient.Tok
 	iVM, err := iregion.GetIVMById(self.ExternalId)
 	if err == nil { //漂移归位
 		if hostId := iVM.GetIHostId(); len(hostId) > 0 {
-			host, err := db.FetchByExternalId(HostManager, hostId)
+			host, err := db.FetchByExternalIdAndManagerId(HostManager, hostId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				host := self.GetHost()
+				if host != nil {
+					return q.Equals("manager_id", host.ManagerId)
+				}
+				return q
+			})
 			if err == nil {
 				_, err = db.Update(self, func() error {
 					self.HostId = host.GetId()
@@ -2692,7 +2702,8 @@ func getCloudNicNetwork(vnic cloudprovider.ICloudNic, host *SHost, ipList []stri
 	vnet := vnic.GetINetwork()
 	if vnet == nil {
 		if vnic.InClassicNetwork() {
-			vpc, err := VpcManager.GetOrCreateVpcForClassicNetwork(host)
+			region := host.GetRegion()
+			vpc, err := VpcManager.GetOrCreateVpcForClassicNetwork(region)
 			if err != nil {
 				return nil, errors.Wrap(err, "NewVpcForClassicNetwork")
 			}
@@ -2715,7 +2726,13 @@ func getCloudNicNetwork(vnic cloudprovider.ICloudNic, host *SHost, ipList []stri
 		// find network by IP
 		return host.getNetworkOfIPOnHost(ip)
 	}
-	localNetObj, err := db.FetchByExternalId(NetworkManager, vnet.GetGlobalId())
+	localNetObj, err := db.FetchByExternalIdAndManagerId(NetworkManager, vnet.GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		vpc := VpcManager.Query().SubQuery()
+		wire := WireManager.Query().SubQuery()
+		return q.Join(wire, sqlchemy.Equals(q.Field("wire_id"), wire.Field("id"))).
+			Join(vpc, sqlchemy.Equals(wire.Field("vpc_id"), vpc.Field("id"))).
+			Filter(sqlchemy.Equals(vpc.Field("manager_id"), host.ManagerId))
+	})
 	if err != nil {
 		return nil, fmt.Errorf("Cannot find network of external_id %s: %v", vnet.GetGlobalId(), err)
 	}
@@ -2915,7 +2932,7 @@ func (self *SGuest) SyncVMDisks(ctx context.Context, userCred mcclient.TokenCred
 		if len(vdisks[i].GetGlobalId()) == 0 {
 			continue
 		}
-		disk, err := DiskManager.syncCloudDisk(ctx, userCred, provider, vdisks[i], i, syncOwnerId)
+		disk, err := DiskManager.syncCloudDisk(ctx, userCred, provider, vdisks[i], i, syncOwnerId, host.ManagerId)
 		if err != nil {
 			log.Errorf("syncCloudDisk error: %v", err)
 			result.Error(err)
@@ -5271,7 +5288,9 @@ func (guest *SGuest) GetUsages() []db.IUsage {
 }

 var (
-	serverNameREG = regexp.MustCompile(`^[a-z$][a-z0-9-${}.]*$`)
+	// `^[a-zA-Z][a-zA-Z0-9._@-]*$`)
+	serverNameREG = regexp.MustCompile(`^[a-zA-Z$][a-zA-Z0-9-${}.]*$`)
+	hostnameREG   = regexp.MustCompile(`^[a-z$][a-z0-9-${}.]*$`)
 )

 func (manager *SGuestManager) ValidateName(name string) error {
@@ -5280,3 +5299,10 @@ func (manager *SGuestManager) ValidateName(name string) error {
 	}
 	return httperrors.NewInputParameterError("name starts with letter, and contains letter, number and - only")
 }
+
+func (manager *SGuestManager) ValidateNameLoginAccount(name string) error {
+	if hostnameREG.MatchString(name) {
+		return nil
+	}
+	return httperrors.NewInputParameterError("name starts with letter, and contains letter, number and - only")
+}
--- a/pkg/compute/models/host_recycle.go
+++ b/pkg/compute/models/host_recycle.go
@@ -686,7 +686,7 @@ func (host *SHost) RebuildRecycledGuest(ctx context.Context, userCred mcclient.T
 			log.Errorf("disk.SetExternalId fail %s", err)
 			return err
 		}
-		err = disk.syncWithCloudDisk(ctx, userCred, iprovider, idisks[i], i, guest.GetOwnerId())
+		err = disk.syncWithCloudDisk(ctx, userCred, iprovider, idisks[i], i, guest.GetOwnerId(), host.ManagerId)
 		if err != nil {
 			log.Errorf("disk.syncWithCloudDisk fail %s", err)
 			return err
--- a/pkg/compute/models/hosts.go
+++ b/pkg/compute/models/hosts.go
@@ -1893,7 +1893,9 @@ func (self *SHost) Attach2Storage(ctx context.Context, userCred mcclient.TokenCr
 }

 func (self *SHost) newCloudHostStorage(ctx context.Context, userCred mcclient.TokenCredential, extStorage cloudprovider.ICloudStorage, provider *SCloudprovider) (*SStorage, error) {
-	storageObj, err := db.FetchByExternalId(StorageManager, extStorage.GetGlobalId())
+	storageObj, err := db.FetchByExternalIdAndManagerId(StorageManager, extStorage.GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		return q.Equals("manager_id", provider.Id)
+	})
 	if err != nil {
 		if err == sql.ErrNoRows {
 			// no cloud storage found, this may happen for on-premise host
@@ -2008,7 +2010,10 @@ func (self *SHost) Attach2Wire(ctx context.Context, userCred mcclient.TokenCrede
 }

 func (self *SHost) newCloudHostWire(ctx context.Context, userCred mcclient.TokenCredential, extWire cloudprovider.ICloudWire) error {
-	wireObj, err := db.FetchByExternalId(WireManager, extWire.GetGlobalId())
+	wireObj, err := db.FetchByExternalIdAndManagerId(WireManager, extWire.GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		sq := VpcManager.Query().SubQuery()
+		return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("vpc_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), self.ManagerId))
+	})
 	if err != nil {
 		log.Errorf("%s", err)
 		return nil
@@ -2076,7 +2081,10 @@ func (self *SHost) SyncHostVMs(ctx context.Context, userCred mcclient.TokenCrede
 	}

 	for i := 0; i < len(added); i += 1 {
-		vm, err := db.FetchByExternalId(GuestManager, added[i].GetGlobalId())
+		vm, err := db.FetchByExternalIdAndManagerId(GuestManager, added[i].GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			sq := HostManager.Query().SubQuery()
+			return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("host_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), self.ManagerId))
+		})
 		if err != nil && err != sql.ErrNoRows {
 			log.Errorf("failed to found guest by externalId %s error: %v", added[i].GetGlobalId(), err)
 			continue
@@ -2088,7 +2096,9 @@ func (self *SHost) SyncHostVMs(ctx context.Context, userCred mcclient.TokenCrede
 				log.Errorf("failed to found ihost from vm %s", added[i].GetGlobalId())
 				continue
 			}
-			_host, err := db.FetchByExternalId(HostManager, ihost.GetGlobalId())
+			_host, err := db.FetchByExternalIdAndManagerId(HostManager, ihost.GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", self.ManagerId)
+			})
 			if err != nil {
 				log.Errorf("failed to found host by externalId %s", ihost.GetGlobalId())
 				continue
@@ -2604,6 +2614,10 @@ func (self *SHost) getMoreDetails(ctx context.Context, out api.HostDetails, show
 	if self.EnableHealthCheck && hostHealthChecker != nil {
 		out.AllowHealthCheck = true
 	}
+	if self.GetMetadata("__auto_migrate_on_host_down", nil) == "enable" {
+		out.AutoMigrateOnHostDown = true
+	}
+
 	return out
 }

--- a/pkg/compute/models/initdb.go
+++ b/pkg/compute/models/initdb.go
@@ -56,6 +56,7 @@ func InitDB() error {
 		DynamicschedtagManager,
 		ServerSkuManager,
 		ElasticcacheSkuManager,
+		ExternalProjectManager,
 	} {
 		err := manager.InitializeData()
 		if err != nil {
--- a/pkg/compute/models/loadbalanceragents.go
+++ b/pkg/compute/models/loadbalanceragents.go
@@ -544,6 +544,9 @@ func (man *SLoadbalancerAgentManager) CleanPendingDeleteLoadbalancers(ctx contex
 }

 func (lbagent *SLoadbalancerAgent) ValidateUpdateData(ctx context.Context, userCred mcclient.TokenCredential, query jsonutils.JSONObject, data *jsonutils.JSONDict) (*jsonutils.JSONDict, error) {
+	if data.Contains("cluster_id") {
+		data.Remove("cluster_id")
+	}
 	{
 		keyV := map[string]validators.IValidator{
 			"hb_timeout": validators.NewNonNegativeValidator("hb_timeout").Optional(true),
--- a/pkg/compute/models/loadbalanceragents_deploy.go
+++ b/pkg/compute/models/loadbalanceragents_deploy.go
@@ -114,6 +114,8 @@ func (lbagent *SLoadbalancerAgent) deploy(ctx context.Context, userCred mcclient
 	}
 	switch input.DeployMethod {
 	case compute_apis.DeployMethodYum:
+		fallthrough
+	default:
 		if v, ok := input.Host.GetVar("repo_base_url"); !ok || v == "" {
 			return nil, httperrors.NewBadRequestError("use yum requires valid repo_base_url")
 		}
@@ -142,8 +144,6 @@ func (lbagent *SLoadbalancerAgent) deploy(ctx context.Context, userCred mcclient
 			},
 		)
 	case compute_apis.DeployMethodCopy:
-		fallthrough
-	default:
 		// glob for rpms
 		basenames := []string{
 			"packages/telegraf",
@@ -275,6 +275,22 @@ func (lbagent *SLoadbalancerAgent) validateHost(ctx context.Context, userCred mc
 		if utils.IsInStringArray(guest.Hypervisor, compute_apis.PUBLIC_CLOUD_HYPERVISORS) {
 			return httperrors.NewBadRequestError("lbagent cannot be deployed on public guests")
 		}
+		if guest.Status != compute_apis.VM_RUNNING {
+			return httperrors.NewBadRequestError("server is in %q state, want %q",
+				guest.Status, compute_apis.VM_RUNNING)
+		}
+
+		// Better make this explicit in the API
+		if guest.SrcIpCheck.Bool() || guest.SrcMacCheck.Bool() {
+			sess := auth.GetSession(ctx, userCred, "", "")
+			params := jsonutils.NewDict()
+			params.Set("src_ip_check", jsonutils.JSONFalse)
+			params.Set("src_mac_check", jsonutils.JSONFalse)
+			_, err := mcclient_modules.Servers.PerformAction(sess, guest.Id, "modify-src-check", params)
+			if err != nil {
+				return errors.Wrapf(err, "turn off src check of guest %s(%s)", guest.Name, guest.Id)
+			}
+		}
 	}
 	return nil
 }
--- a/pkg/compute/models/loadbalancerawscachedlbb.go
+++ b/pkg/compute/models/loadbalancerawscachedlbb.go
@@ -20,6 +20,7 @@ import (

 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/compare"
+	"yunion.io/x/sqlchemy"

 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
@@ -194,7 +195,10 @@ func (lbb *SAwsCachedLb) syncRemoveCloudLoadbalancerBackend(ctx context.Context,
 func (lbb *SAwsCachedLb) constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend cloudprovider.ICloudLoadbalancerBackend) error {
 	lbb.Status = extLoadbalancerBackend.GetStatus()

-	instance, err := db.FetchByExternalId(GuestManager, extLoadbalancerBackend.GetBackendId())
+	instance, err := db.FetchByExternalIdAndManagerId(GuestManager, extLoadbalancerBackend.GetBackendId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		sq := HostManager.Query().SubQuery()
+		return q.Join(sq, sqlchemy.Equals(q.Field("host_id"), sq.Field("id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), lbb.ManagerId))
+	})
 	if err != nil {
 		return err
 	}
--- a/pkg/compute/models/loadbalancerawscachedlbbg.go
+++ b/pkg/compute/models/loadbalancerawscachedlbbg.go
@@ -232,7 +232,9 @@ func (man *SAwsCachedLbbgManager) SyncLoadbalancerBackendgroups(ctx context.Cont
 		var elb *SLoadbalancer
 		elbId := commonext[i].GetLoadbalancerId()
 		if len(elbId) > 0 {
-			ielb, err := db.FetchByExternalId(LoadbalancerManager, elbId)
+			ielb, err := db.FetchByExternalIdAndManagerId(LoadbalancerManager, elbId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", provider.Id)
+			})
 			if err == nil {
 				elb = ielb.(*SLoadbalancer)
 			}
--- a/pkg/compute/models/loadbalancerbackends.go
+++ b/pkg/compute/models/loadbalancerbackends.go
@@ -264,6 +264,14 @@ func (lbb *SLoadbalancerBackend) AllowPerformStatus(ctx context.Context, userCre
 	return false
 }

+func (lbb *SLoadbalancerBackend) GetCloudproviderId() string {
+	lbbg := lbb.GetLoadbalancerBackendGroup()
+	if lbbg != nil {
+		return lbbg.GetCloudproviderId()
+	}
+	return ""
+}
+
 func (lbb *SLoadbalancerBackend) GetLoadbalancerBackendGroup() *SLoadbalancerBackendGroup {
 	backendgroup, err := LoadbalancerBackendGroupManager.FetchById(lbb.BackendGroupId)
 	if err != nil {
@@ -514,7 +522,7 @@ func (man *SLoadbalancerBackendManager) SyncLoadbalancerBackends(ctx context.Con
 	return syncResult
 }

-func (lbb *SLoadbalancerBackend) constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend cloudprovider.ICloudLoadbalancerBackend) error {
+func (lbb *SLoadbalancerBackend) constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend cloudprovider.ICloudLoadbalancerBackend, managerId string) error {
 	// lbb.Name = extLoadbalancerBackend.GetName()
 	lbb.Status = extLoadbalancerBackend.GetStatus()

@@ -524,7 +532,10 @@ func (lbb *SLoadbalancerBackend) constructFieldsFromCloudLoadbalancerBackend(ext
 	lbb.BackendType = extLoadbalancerBackend.GetBackendType()
 	lbb.BackendRole = extLoadbalancerBackend.GetBackendRole()

-	instance, err := db.FetchByExternalId(GuestManager, extLoadbalancerBackend.GetBackendId())
+	instance, err := db.FetchByExternalIdAndManagerId(GuestManager, extLoadbalancerBackend.GetBackendId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		sq := HostManager.Query().SubQuery()
+		return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("host_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), managerId))
+	})
 	if err != nil {
 		return err
 	}
@@ -555,7 +566,7 @@ func (lbb *SLoadbalancerBackend) syncRemoveCloudLoadbalancerBackend(ctx context.

 func (lbb *SLoadbalancerBackend) SyncWithCloudLoadbalancerBackend(ctx context.Context, userCred mcclient.TokenCredential, extLoadbalancerBackend cloudprovider.ICloudLoadbalancerBackend, syncOwnerId mcclient.IIdentityProvider, provider *SCloudprovider) error {
 	diff, err := db.UpdateWithLock(ctx, lbb, func() error {
-		return lbb.constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend)
+		return lbb.constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend, provider.Id)
 	})
 	if err != nil {
 		return err
@@ -605,7 +616,7 @@ func (man *SLoadbalancerBackendManager) newFromCloudLoadbalancerBackend(ctx cont
 	}
 	lbb.Name = newName

-	if err := lbb.constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend); err != nil {
+	if err := lbb.constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend, provider.Id); err != nil {
 		return nil, err
 	}

--- a/pkg/compute/models/loadbalancercachedacls.go
+++ b/pkg/compute/models/loadbalancercachedacls.go
@@ -324,7 +324,10 @@ func (acl *SCachedLoadbalancerAcl) SyncWithCloudLoadbalancerAcl(ctx context.Cont
 		} else {
 			ext_listener_id := extAcl.GetAclListenerID()
 			if len(ext_listener_id) > 0 {
-				ilistener, err := db.FetchByExternalId(LoadbalancerListenerManager, ext_listener_id)
+				ilistener, err := db.FetchByExternalIdAndManagerId(LoadbalancerListenerManager, ext_listener_id, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+					sq := LoadbalancerManager.Query().SubQuery()
+					return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("loadbalancer_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), acl.ManagerId))
+				})
 				if err != nil {
 					return errors.Wrap(err, "cacheLoadbalancerAcl.sync.FetchByExternalId")
 				}
--- a/pkg/compute/models/loadbalancerclusterresource.go
+++ b/pkg/compute/models/loadbalancerclusterresource.go
@@ -33,7 +33,7 @@ import (

 type SLoadbalancerClusterResourceBase struct {
 	// 归属LB集群
-	ClusterId string `width:"36" charset:"ascii" nullable:"false" list:"user" create:"required" json:"cluster_id"`
+	ClusterId string `width:"36" charset:"ascii" nullable:"false" list:"user" update:"user" create:"optional" json:"cluster_id"`
 }

 type SLoadbalancerClusterResourceBaseManager struct {
--- a/pkg/compute/models/loadbalancerhuaweicachedlbb.go
+++ b/pkg/compute/models/loadbalancerhuaweicachedlbb.go
@@ -22,6 +22,7 @@ import (
 	"yunion.io/x/log"
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/compare"
+	"yunion.io/x/sqlchemy"

 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
@@ -197,7 +198,10 @@ func (lbb *SHuaweiCachedLb) syncRemoveCloudLoadbalancerBackend(ctx context.Conte
 func (lbb *SHuaweiCachedLb) constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend cloudprovider.ICloudLoadbalancerBackend) error {
 	lbb.Status = extLoadbalancerBackend.GetStatus()

-	instance, err := db.FetchByExternalId(GuestManager, extLoadbalancerBackend.GetBackendId())
+	instance, err := db.FetchByExternalIdAndManagerId(GuestManager, extLoadbalancerBackend.GetBackendId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		sq := HostManager.Query().SubQuery()
+		return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("host_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), lbb.ManagerId))
+	})
 	if err != nil {
 		return err
 	}
@@ -286,17 +290,6 @@ func (man *SHuaweiCachedLbManager) newFromCloudLoadbalancerBackend(ctx context.C
 }

 func newLocalBackendFromCloudLoadbalancerBackend(ctx context.Context, userCred mcclient.TokenCredential, loadbalancerBackendgroup *SLoadbalancerBackendGroup, extLoadbalancerBackend cloudprovider.ICloudLoadbalancerBackend, syncOwnerId mcclient.IIdentityProvider) (*SLoadbalancerBackend, error) {
-	instance, err := db.FetchByExternalId(GuestManager, extLoadbalancerBackend.GetBackendId())
-	if err != nil {
-		return nil, err
-	}
-
-	guest := instance.(*SGuest)
-	//address, err := LoadbalancerBackendManager.GetGuestAddress(guest)
-	//if err != nil {
-	//	return nil, err
-	//}
-
 	lbbgRegion := loadbalancerBackendgroup.GetRegion()
 	if lbbgRegion == nil {
 		return nil, errors.Wrap(httperrors.ErrInvalidStatus, "loadbalancerBackendgroup is not attached to any region")
@@ -306,6 +299,17 @@ func newLocalBackendFromCloudLoadbalancerBackend(ctx context.Context, userCred m
 		return nil, errors.Wrap(httperrors.ErrInvalidStatus, "loadbalancerBackendgroup is not attached to any cloudprovider")
 	}

+	instance, err := db.FetchByExternalIdAndManagerId(GuestManager, extLoadbalancerBackend.GetBackendId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		sq := HostManager.Query().SubQuery()
+		return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("host_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), lbbgProvider.Id))
+	})
+
+	guest := instance.(*SGuest)
+	//address, err := LoadbalancerBackendManager.GetGuestAddress(guest)
+	//if err != nil {
+	//	return nil, err
+	//}
+
 	man := LoadbalancerBackendManager
 	q := man.Query().IsFalse("pending_deleted")
 	q = q.Equals("weight", extLoadbalancerBackend.GetWeight()).Equals("port", extLoadbalancerBackend.GetPort())
@@ -350,7 +354,7 @@ func newLocalBackendFromCloudLoadbalancerBackend(ctx context.Context, userCred m
 		}
 		lbb.Name = newName

-		if err := lbb.constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend); err != nil {
+		if err := lbb.constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend, lbbgProvider.Id); err != nil {
 			return nil, err
 		}

--- a/pkg/compute/models/loadbalancerlistenerresource.go
+++ b/pkg/compute/models/loadbalancerlistenerresource.go
@@ -62,6 +62,14 @@ func (self *SLoadbalancerListenerResourceBase) GetLoadbalancerListener() *SLoadb
 	return listener.(*SLoadbalancerListener)
 }

+func (self *SLoadbalancerListenerResourceBase) GetCloudproviderId() string {
+	cloudprovider := self.GetCloudprovider()
+	if cloudprovider != nil {
+		return cloudprovider.Id
+	}
+	return ""
+}
+
 func (self *SLoadbalancerListenerResourceBase) GetCloudprovider() *SCloudprovider {
 	listener := self.GetLoadbalancerListener()
 	if listener != nil {
--- a/pkg/compute/models/loadbalancerlisteners.go
+++ b/pkg/compute/models/loadbalancerlisteners.go
@@ -955,7 +955,9 @@ func (lblis *SLoadbalancerListener) constructFieldsFromCloudListener(userCred mc

 	lblis.AclType = extListener.GetAclType()
 	if aclID := extListener.GetAclId(); len(aclID) > 0 {
-		if _acl, err := db.FetchByExternalId(CachedLoadbalancerAclManager, aclID); err == nil {
+		if _acl, err := db.FetchByExternalIdAndManagerId(CachedLoadbalancerAclManager, aclID, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			return q.Equals("manager_id", lb.ManagerId)
+		}); err == nil {
 			acl := _acl.(*SCachedLoadbalancerAcl)
 			lblis.CachedAclId = acl.GetId()
 			lblis.AclId = acl.AclId
@@ -991,7 +993,9 @@ func (lblis *SLoadbalancerListener) constructFieldsFromCloudListener(userCred mc
 		lblis.TLSCipherPolicy = extListener.GetTLSCipherPolicy()
 		lblis.EnableHttp2 = extListener.HTTP2Enabled()
 		if certificateId := extListener.GetCertificateId(); len(certificateId) > 0 {
-			if _cert, err := db.FetchByExternalId(CachedLoadbalancerCertificateManager, certificateId); err == nil {
+			if _cert, err := db.FetchByExternalIdAndManagerId(CachedLoadbalancerCertificateManager, certificateId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", lb.ManagerId)
+			}); err == nil {
 				cert := _cert.(*SCachedLoadbalancerCertificate)
 				lblis.CachedCertificateId = cert.GetId()
 				lblis.CertificateId = cert.CertificateId
@@ -1025,7 +1029,9 @@ func (lblis *SLoadbalancerListener) constructFieldsFromCloudListener(userCred mc
 	switch lblis.GetProviderName() {
 	case api.CLOUD_PROVIDER_HUAWEI:
 		if len(groupId) > 0 {
-			group, err := db.FetchByExternalId(HuaweiCachedLbbgManager, groupId)
+			group, err := db.FetchByExternalIdAndManagerId(HuaweiCachedLbbgManager, groupId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", lb.ManagerId)
+			})
 			if err != nil {
 				if err == sql.ErrNoRows {
 					lblis.BackendGroupId = ""
@@ -1037,7 +1043,9 @@ func (lblis *SLoadbalancerListener) constructFieldsFromCloudListener(userCred mc
 		}
 	case api.CLOUD_PROVIDER_AWS:
 		if len(groupId) > 0 {
-			group, err := db.FetchByExternalId(AwsCachedLbbgManager, groupId)
+			group, err := db.FetchByExternalIdAndManagerId(AwsCachedLbbgManager, groupId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", lb.ManagerId)
+			})
 			if err != nil {
 				log.Errorf("Fetch aws loadbalancer backendgroup by external id %s failed: %s", groupId, err)
 			} else {
@@ -1060,7 +1068,9 @@ func (lblis *SLoadbalancerListener) constructFieldsFromCloudListener(userCred mc
 			lb := lblis.GetLoadbalancer()
 			if forward, _ := lb.LBInfo.Int("Forward"); forward == 1 {
 				// 应用型负载均衡
-				group, err := db.FetchByExternalId(QcloudCachedLbbgManager, groupId)
+				group, err := db.FetchByExternalIdAndManagerId(QcloudCachedLbbgManager, groupId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+					return q.Equals("manager_id", lb.ManagerId)
+				})
 				if err != nil {
 					log.Errorf("Fetch qcloud loadbalancer backendgroup by external id %s failed: %s", groupId, err)
 				} else {
@@ -1068,7 +1078,10 @@ func (lblis *SLoadbalancerListener) constructFieldsFromCloudListener(userCred mc
 				}
 			} else {
 				// 传统型负载均衡
-				if group, err := db.FetchByExternalId(LoadbalancerBackendGroupManager, groupId); err == nil {
+				if group, err := db.FetchByExternalIdAndManagerId(LoadbalancerBackendGroupManager, groupId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+					sq := LoadbalancerManager.Query().SubQuery()
+					return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("loadbalancer_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), lb.ManagerId))
+				}); err == nil {
 					lblis.BackendGroupId = group.GetId()
 				}
 			}
@@ -1076,13 +1089,16 @@ func (lblis *SLoadbalancerListener) constructFieldsFromCloudListener(userCred mc
 	default:
 		if len(lblis.BackendGroupId) == 0 && len(groupId) == 0 {
 			lblis.BackendGroupId = lb.BackendGroupId
-		} else if group, err := db.FetchByExternalId(LoadbalancerBackendGroupManager, groupId); err == nil {
+		} else if group, err := db.FetchByExternalIdAndManagerId(LoadbalancerBackendGroupManager, groupId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			sq := LoadbalancerManager.Query().SubQuery()
+			return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("loadbalancer_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), lb.ManagerId))
+		}); err == nil {
 			lblis.BackendGroupId = group.GetId()
 		}
 	}
 }

-func (lblis *SLoadbalancerListener) updateCachedLoadbalancerBackendGroupAssociate(ctx context.Context, extListener cloudprovider.ICloudLoadbalancerListener) error {
+func (lblis *SLoadbalancerListener) updateCachedLoadbalancerBackendGroupAssociate(ctx context.Context, extListener cloudprovider.ICloudLoadbalancerListener, managerId string) error {
 	exteralLbbgId := extListener.GetBackendGroupId()
 	if len(exteralLbbgId) == 0 {
 		return nil
@@ -1090,7 +1106,9 @@ func (lblis *SLoadbalancerListener) updateCachedLoadbalancerBackendGroupAssociat

 	switch lblis.GetProviderName() {
 	case api.CLOUD_PROVIDER_HUAWEI:
-		_group, err := db.FetchByExternalId(HuaweiCachedLbbgManager, exteralLbbgId)
+		_group, err := db.FetchByExternalIdAndManagerId(HuaweiCachedLbbgManager, exteralLbbgId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			return q.Equals("manager_id", managerId)
+		})
 		if err != nil {
 			if err == sql.ErrNoRows {
 				lblis.BackendGroupId = ""
@@ -1115,7 +1133,9 @@ func (lblis *SLoadbalancerListener) updateCachedLoadbalancerBackendGroupAssociat
 	case api.CLOUD_PROVIDER_QCLOUD:
 		lb := lblis.GetLoadbalancer()
 		if forward, _ := lb.LBInfo.Int("Forward"); forward == 1 {
-			_group, err := db.FetchByExternalId(QcloudCachedLbbgManager, exteralLbbgId)
+			_group, err := db.FetchByExternalIdAndManagerId(QcloudCachedLbbgManager, exteralLbbgId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", managerId)
+			})
 			if err != nil {
 				if err == sql.ErrNoRows {
 					lblis.BackendGroupId = ""
@@ -1167,7 +1187,7 @@ func (lblis *SLoadbalancerListener) SyncWithCloudLoadbalancerListener(ctx contex
 		return err
 	}

-	err = lblis.updateCachedLoadbalancerBackendGroupAssociate(ctx, extListener)
+	err = lblis.updateCachedLoadbalancerBackendGroupAssociate(ctx, extListener, lb.ManagerId)
 	if err != nil {
 		return errors.Wrap(err, "LoadbalancerListener.SyncWithCloudLoadbalancerListener")
 	}
@@ -1199,7 +1219,7 @@ func (man *SLoadbalancerListenerManager) newFromCloudLoadbalancerListener(ctx co
 		return nil, err
 	}

-	err = lblis.updateCachedLoadbalancerBackendGroupAssociate(ctx, extListener)
+	err = lblis.updateCachedLoadbalancerBackendGroupAssociate(ctx, extListener, lb.ManagerId)
 	if err != nil {
 		return nil, errors.Wrap(err, "LoadbalancerListener.newFromCloudLoadbalancerListener")
 	}
--- a/pkg/compute/models/loadbalancerqcloudcachedlbb.go
+++ b/pkg/compute/models/loadbalancerqcloudcachedlbb.go
@@ -21,6 +21,7 @@ import (
 	"yunion.io/x/jsonutils"
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/compare"
+	"yunion.io/x/sqlchemy"

 	api "yunion.io/x/onecloud/pkg/apis/compute"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
@@ -94,7 +95,10 @@ func (lbb *SQcloudCachedLb) syncRemoveCloudLoadbalancerBackend(ctx context.Conte
 func (lbb *SQcloudCachedLb) constructFieldsFromCloudLoadbalancerBackend(extLoadbalancerBackend cloudprovider.ICloudLoadbalancerBackend) error {
 	lbb.Status = extLoadbalancerBackend.GetStatus()

-	instance, err := db.FetchByExternalId(GuestManager, extLoadbalancerBackend.GetBackendId())
+	instance, err := db.FetchByExternalIdAndManagerId(GuestManager, extLoadbalancerBackend.GetBackendId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		sq := HostManager.Query().SubQuery()
+		return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("host_id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), lbb.ManagerId))
+	})
 	if err != nil {
 		return err
 	}
--- a/pkg/compute/models/loadbalancers.go
+++ b/pkg/compute/models/loadbalancers.go
@@ -53,6 +53,8 @@ type SLoadbalancerManager struct {

 	SManagedResourceBaseManager
 	SCloudregionResourceBaseManager
+
+	SLoadbalancerClusterResourceBaseManager
 }

 var LoadbalancerManager *SLoadbalancerManager
@@ -107,8 +109,7 @@ type SLoadbalancer struct {
 	// 虚拟私有网络Id
 	// VpcId string `width:"36" charset:"ascii" nullable:"true" list:"user" create:"optional"`

-	// 负载均衡集群Id
-	ClusterId string `width:"36" charset:"ascii" nullable:"true" list:"user" create:"optional" json:"cluster_id"`
+	SLoadbalancerClusterResourceBase

 	// 计费类型
 	ChargeType string `list:"user" get:"user" create:"optional" update:"user" json:"charge_type"`
@@ -384,6 +385,10 @@ func (lb *SLoadbalancer) GetRegion() *SCloudregion {
 	return lb.SCloudregionResourceBase.GetRegion()
 }

+func (lb *SLoadbalancer) GetCloudproviderId() string {
+	return lb.SManagedResourceBase.GetCloudproviderId()
+}
+
 func (lb *SLoadbalancer) GetZone() *SZone {
 	return lb.SZoneResourceBase.GetZone()
 }
@@ -548,6 +553,7 @@ func (man *SLoadbalancerManager) FetchCustomizeColumns(
 ) []api.LoadbalancerDetails {
 	rows := make([]api.LoadbalancerDetails, len(objs))

+	clusterRows := man.SLoadbalancerClusterResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
 	virtRows := man.SVirtualResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
 	manRows := man.SManagedResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
 	regRows := man.SCloudregionResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
@@ -557,6 +563,8 @@ func (man *SLoadbalancerManager) FetchCustomizeColumns(

 	for i := range rows {
 		rows[i] = api.LoadbalancerDetails{
+			LoadbalancerClusterResourceInfo: clusterRows[i],
+
 			VirtualResourceDetails:  virtRows[i],
 			ManagedResourceInfo:     manRows[i],
 			CloudregionResourceInfo: regRows[i],
@@ -722,7 +730,7 @@ func (man *SLoadbalancerManager) SyncLoadbalancers(ctx context.Context, userCred
 		if err != nil {
 			syncResult.UpdateError(err)
 		} else {
-			syncMetadata(ctx, userCred, &commondb[i], commonext[i])
+			syncVirtualResourceMetadata(ctx, userCred, &commondb[i], commonext[i])
 			localLbs = append(localLbs, commondb[i])
 			remoteLbs = append(remoteLbs, commonext[i])
 			syncResult.Update()
@@ -733,7 +741,7 @@ func (man *SLoadbalancerManager) SyncLoadbalancers(ctx context.Context, userCred
 		if err != nil {
 			syncResult.AddError(err)
 		} else {
-			syncMetadata(ctx, userCred, new, added[i])
+			syncVirtualResourceMetadata(ctx, userCred, new, added[i])
 			localLbs = append(localLbs, *new)
 			remoteLbs = append(remoteLbs, added[i])
 			syncResult.Add()
@@ -742,11 +750,18 @@ func (man *SLoadbalancerManager) SyncLoadbalancers(ctx context.Context, userCred
 	return localLbs, remoteLbs, syncResult
 }

-func getExtLbNetworkIds(extLb cloudprovider.ICloudLoadbalancer) []string {
+func getExtLbNetworkIds(extLb cloudprovider.ICloudLoadbalancer, managerId string) []string {
 	extNetworkIds := extLb.GetNetworkIds()
 	lbNetworkIds := []string{}
 	for _, networkId := range extNetworkIds {
-		if network, err := db.FetchByExternalId(NetworkManager, networkId); err == nil && network != nil {
+		network, err := db.FetchByExternalIdAndManagerId(NetworkManager, networkId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			wire := WireManager.Query().SubQuery()
+			vpc := VpcManager.Query().SubQuery()
+			return q.Join(wire, sqlchemy.Equals(wire.Field("id"), q.Field("wire_id"))).
+				Join(vpc, sqlchemy.Equals(vpc.Field("id"), wire.Field("vpc_id"))).
+				Filter(sqlchemy.Equals(vpc.Field("manager_id"), managerId))
+		})
+		if err == nil && network != nil {
 			lbNetworkIds = append(lbNetworkIds, network.GetId())
 		}
 	}
@@ -774,11 +789,13 @@ func (man *SLoadbalancerManager) newFromCloudLoadbalancer(ctx context.Context, u
 	lb.ChargeType = extLb.GetChargeType()
 	lb.EgressMbps = extLb.GetEgressMbps()
 	lb.ExternalId = extLb.GetGlobalId()
-	lbNetworkIds := getExtLbNetworkIds(extLb)
+	lbNetworkIds := getExtLbNetworkIds(extLb, lb.ManagerId)
 	lb.NetworkId = strings.Join(lbNetworkIds, ",")

 	if vpcId := extLb.GetVpcId(); len(vpcId) > 0 {
-		if vpc, err := db.FetchByExternalId(VpcManager, vpcId); err == nil && vpc != nil {
+		if vpc, err := db.FetchByExternalIdAndManagerId(VpcManager, vpcId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			return q.Equals("manager_id", provider.Id)
+		}); err == nil && vpc != nil {
 			lb.VpcId = vpc.GetId()
 		}
 	}
@@ -950,14 +967,16 @@ func (lb *SLoadbalancer) SyncWithCloudLoadbalancer(ctx context.Context, userCred
 		lb.EgressMbps = extLb.GetEgressMbps()
 		lb.ChargeType = extLb.GetChargeType()
 		lb.ManagerId = provider.Id
-		lbNetworkIds := getExtLbNetworkIds(extLb)
+		lbNetworkIds := getExtLbNetworkIds(extLb, lb.ManagerId)
 		lb.NetworkId = strings.Join(lbNetworkIds, ",")
 		if extLb.GetMetadata() != nil {
 			lb.LBInfo = extLb.GetMetadata()
 		}

 		if vpcId := extLb.GetVpcId(); len(vpcId) > 0 {
-			if vpc, err := db.FetchByExternalId(VpcManager, vpcId); err == nil && vpc != nil {
+			if vpc, err := db.FetchByExternalIdAndManagerId(VpcManager, vpcId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				return q.Equals("manager_id", provider.Id)
+			}); err == nil && vpc != nil {
 				lb.VpcId = vpc.GetId()
 			}
 		}
@@ -967,7 +986,7 @@ func (lb *SLoadbalancer) SyncWithCloudLoadbalancer(ctx context.Context, userCred

 	db.OpsLog.LogSyncUpdate(lb, diff, userCred)

-	networkIds := getExtLbNetworkIds(extLb)
+	networkIds := getExtLbNetworkIds(extLb, lb.ManagerId)
 	SyncCloudProject(userCred, lb, syncOwnerId, extLb, provider.Id)
 	lb.syncLoadbalancerNetwork(ctx, userCred, networkIds)

--- a/pkg/compute/models/managedresource.go
+++ b/pkg/compute/models/managedresource.go
@@ -46,6 +46,10 @@ type SManagedResourceBaseManager struct {
 	managerIdFieldName string
 }

+func (self *SManagedResourceBase) GetCloudproviderId() string {
+	return self.ManagerId
+}
+
 func ValidateCloudproviderResourceInput(userCred mcclient.TokenCredential, query api.CloudproviderResourceInput) (*SCloudprovider, api.CloudproviderResourceInput, error) {
 	managerObj, err := CloudproviderManager.FetchByIdOrName(userCred, query.Cloudprovider)
 	if err != nil {
@@ -557,7 +561,7 @@ func _managedResourceFilterByAccount(managerIdFieldName string, q *sqlchemy.SQue

 func managedResourceFilterByZone(q *sqlchemy.SQuery, query api.ZonalFilterListInput, filterField string, subqFunc func() *sqlchemy.SQuery) (*sqlchemy.SQuery, error) {
 	zoneList := query.ZoneList()
-	if len(zoneList) > 1 {
+	if len(query.Zones) >= 1 {
 		zoneQ := ZoneManager.Query("id")
 		zoneQ = zoneQ.Filter(sqlchemy.OR(
 			sqlchemy.In(zoneQ.Field("id"), zoneList),
--- a/pkg/compute/models/natdtable.go
+++ b/pkg/compute/models/natdtable.go
@@ -237,6 +237,14 @@ func (manager *SNatDEntryManager) SyncNatDTable(ctx context.Context, userCred mc
 	return result
 }

+func (self *SNatDEntry) GetCloudproviderId() string {
+	nat, _ := self.GetNatgateway()
+	if nat != nil {
+		return nat.GetCloudproviderId()
+	}
+	return ""
+}
+
 func (self *SNatDEntry) syncRemoveCloudNatDTable(ctx context.Context, userCred mcclient.TokenCredential) error {
 	lockman.LockObject(ctx, self)
 	defer lockman.ReleaseObject(ctx, self)
--- a/pkg/compute/models/natstable.go
+++ b/pkg/compute/models/natstable.go
@@ -63,6 +63,14 @@ type SNatSEntry struct {
 	SourceCIDR string `width:"22" charset:"ascii" list:"user" create:"required"`
 }

+func (self *SNatSEntry) GetCloudproviderId() string {
+	network, err := self.GetNetwork()
+	if err == nil {
+		return network.GetCloudproviderId()
+	}
+	return ""
+}
+
 func (self *SNatSEntry) GetNetwork() (*SNetwork, error) {
 	if len(self.NetworkId) == 0 {
 		return nil, nil
@@ -253,7 +261,7 @@ func (manager *SNatSEntryManager) SyncNatSTable(ctx context.Context, userCred mc
 	}

 	for i := 0; i < len(commondb); i += 1 {
-		err := commondb[i].SyncWithCloudNatSTable(ctx, userCred, commonext[i], syncOwnerId)
+		err := commondb[i].SyncWithCloudNatSTable(ctx, userCred, commonext[i], syncOwnerId, provider.Id)
 		if err != nil {
 			result.UpdateError(err)
 			continue
@@ -263,7 +271,7 @@ func (manager *SNatSEntryManager) SyncNatSTable(ctx context.Context, userCred mc
 	}

 	for i := 0; i < len(added); i += 1 {
-		routeTableNew, err := manager.newFromCloudNatSTable(ctx, userCred, syncOwnerId, nat, added[i])
+		routeTableNew, err := manager.newFromCloudNatSTable(ctx, userCred, syncOwnerId, nat, added[i], provider.Id)
 		if err != nil {
 			result.AddError(err)
 			continue
@@ -285,13 +293,19 @@ func (self *SNatSEntry) syncRemoveCloudNatSTable(ctx context.Context, userCred m
 	return self.RealDelete(ctx, userCred)
 }

-func (self *SNatSEntry) SyncWithCloudNatSTable(ctx context.Context, userCred mcclient.TokenCredential, extEntry cloudprovider.ICloudNatSEntry, syncOwnerId mcclient.IIdentityProvider) error {
+func (self *SNatSEntry) SyncWithCloudNatSTable(ctx context.Context, userCred mcclient.TokenCredential, extEntry cloudprovider.ICloudNatSEntry, syncOwnerId mcclient.IIdentityProvider, managerId string) error {
 	diff, err := db.UpdateWithLock(ctx, self, func() error {
 		self.Status = extEntry.GetStatus()
 		self.IP = extEntry.GetIP()
 		self.SourceCIDR = extEntry.GetSourceCIDR()
 		if extNetworkId := extEntry.GetNetworkId(); len(extNetworkId) > 0 {
-			network, err := db.FetchByExternalId(NetworkManager, extNetworkId)
+			network, err := db.FetchByExternalIdAndManagerId(NetworkManager, extNetworkId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+				wire := WireManager.Query().SubQuery()
+				vpc := VpcManager.Query().SubQuery()
+				return q.Join(wire, sqlchemy.Equals(wire.Field("id"), q.Field("wire_id"))).
+					Join(vpc, sqlchemy.Equals(vpc.Field("id"), wire.Field("vpc_id"))).
+					Filter(sqlchemy.Equals(vpc.Field("manager_id"), managerId))
+			})
 			if err != nil {
 				return err
 			}
@@ -309,7 +323,7 @@ func (self *SNatSEntry) SyncWithCloudNatSTable(ctx context.Context, userCred mcc
 	return nil
 }

-func (manager *SNatSEntryManager) newFromCloudNatSTable(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, nat *SNatGateway, extEntry cloudprovider.ICloudNatSEntry) (*SNatSEntry, error) {
+func (manager *SNatSEntryManager) newFromCloudNatSTable(ctx context.Context, userCred mcclient.TokenCredential, ownerId mcclient.IIdentityProvider, nat *SNatGateway, extEntry cloudprovider.ICloudNatSEntry, managerId string) (*SNatSEntry, error) {
 	table := SNatSEntry{}
 	table.SetModelManager(manager, &table)

@@ -322,7 +336,13 @@ func (manager *SNatSEntryManager) newFromCloudNatSTable(ctx context.Context, use
 	table.IP = extEntry.GetIP()
 	table.SourceCIDR = extEntry.GetSourceCIDR()
 	if extNetworkId := extEntry.GetNetworkId(); len(extNetworkId) > 0 {
-		network, err := db.FetchByExternalId(NetworkManager, extNetworkId)
+		network, err := db.FetchByExternalIdAndManagerId(NetworkManager, extNetworkId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			wire := WireManager.Query().SubQuery()
+			vpc := VpcManager.Query().SubQuery()
+			return q.Join(wire, sqlchemy.Equals(wire.Field("id"), q.Field("wire_id"))).
+				Join(vpc, sqlchemy.Equals(vpc.Field("id"), wire.Field("vpc_id"))).
+				Filter(sqlchemy.Equals(vpc.Field("manager_id"), managerId))
+		})
 		if err != nil {
 			return nil, err
 		}
--- a/pkg/compute/models/networkinterfacenetwork.go
+++ b/pkg/compute/models/networkinterfacenetwork.go
@@ -22,6 +22,7 @@ import (
 	"yunion.io/x/pkg/errors"
 	"yunion.io/x/pkg/util/compare"
 	"yunion.io/x/pkg/util/netutils"
+	"yunion.io/x/sqlchemy"

 	"yunion.io/x/onecloud/pkg/cloudcommon/db"
 	"yunion.io/x/onecloud/pkg/cloudcommon/db/lockman"
@@ -182,7 +183,13 @@ func (manager *SNetworkinterfacenetworkManager) newFromCloudInterfaceAddress(ctx
 	address.SetModelManager(manager, &address)

 	networkId := ext.GetINetworkId()
-	_network, err := db.FetchByExternalId(NetworkManager, networkId)
+	_network, err := db.FetchByExternalIdAndManagerId(NetworkManager, networkId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		wire := WireManager.Query().SubQuery()
+		vpc := VpcManager.Query().SubQuery()
+		return q.Join(wire, sqlchemy.Equals(wire.Field("id"), q.Field("wire_id"))).
+			Join(vpc, sqlchemy.Equals(vpc.Field("id"), wire.Field("vpc_id"))).
+			Filter(sqlchemy.Equals(vpc.Field("manager_id"), networkinterface.ManagerId))
+	})
 	if err != nil {
 		return errors.Wrapf(err, "newFromCloudInterfaceAddress.FetchByExternalId(%s)", networkId)
 	}
--- a/pkg/compute/models/networkinterfaces.go
+++ b/pkg/compute/models/networkinterfaces.go
@@ -313,7 +313,10 @@ func (self *SNetworkInterface) SyncWithCloudNetworkInterface(ctx context.Context
 func (self *SNetworkInterface) Associate(associateId string) error {
 	switch self.AssociateType {
 	case api.NETWORK_INTERFACE_ASSOCIATE_TYPE_SERVER:
-		guest, err := db.FetchByExternalId(GuestManager, associateId)
+		guest, err := db.FetchByExternalIdAndManagerId(GuestManager, associateId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			sq := HostManager.Query().SubQuery()
+			return q.Join(sq, sqlchemy.Equals(sq.Field("id"), q.Field("host_id"))).Filter(sqlchemy.Equals(q.Field("manager_id"), self.ManagerId))
+		})
 		if err != nil {
 			return errors.Wrapf(err, "failed to get guest for networkinterface %s associateId %s", self.Name, associateId)
 		}
--- a/pkg/compute/models/networks.go
+++ b/pkg/compute/models/networks.go
@@ -309,7 +309,17 @@ func (self *SNetwork) GetNetworkInterfacesCount() (int, error) {
 }

 func (manager *SNetworkManager) GetOrCreateClassicNetwork(wire *SWire) (*SNetwork, error) {
-	_network, err := db.FetchByExternalId(manager, wire.Id)
+	_network, err := db.FetchByExternalIdAndManagerId(manager, wire.Id, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		v := wire.GetVpc()
+		if v != nil {
+			wire := WireManager.Query().SubQuery()
+			vpc := VpcManager.Query().SubQuery()
+			return q.Join(wire, sqlchemy.Equals(wire.Field("id"), q.Field("wire_id"))).
+				Join(vpc, sqlchemy.Equals(vpc.Field("id"), wire.Field("vpc_id"))).
+				Filter(sqlchemy.Equals(vpc.Field("manager_id"), v.ManagerId))
+		}
+		return q
+	})
 	if err == nil {
 		return _network.(*SNetwork), nil
 	}
@@ -631,7 +641,7 @@ func (manager *SNetworkManager) SyncNetworks(ctx context.Context, userCred mccli
 		if err != nil {
 			syncResult.UpdateError(err)
 		} else {
-			syncMetadata(ctx, userCred, &commondb[i], commonext[i])
+			syncVirtualResourceMetadata(ctx, userCred, &commondb[i], commonext[i])
 			localNets = append(localNets, commondb[i])
 			remoteNets = append(remoteNets, commonext[i])
 			syncResult.Update()
@@ -642,7 +652,7 @@ func (manager *SNetworkManager) SyncNetworks(ctx context.Context, userCred mccli
 		if err != nil {
 			syncResult.AddError(err)
 		} else {
-			syncMetadata(ctx, userCred, new, added[i])
+			syncVirtualResourceMetadata(ctx, userCred, new, added[i])
 			localNets = append(localNets, *new)
 			remoteNets = append(remoteNets, added[i])
 			syncResult.Add()
@@ -1612,7 +1622,8 @@ func (self *SNetwork) CustomizeCreate(ctx context.Context, userCred mcclient.Tok
 		if self.ServerType == api.NETWORK_TYPE_GUEST && !self.IsManaged() {
 			if db.IsAdminAllowPerform(userCred, self, "public") && ownerId.GetProjectDomainId() == userCred.GetProjectDomainId() {
 				self.SetShare(rbacutils.ScopeSystem)
-			} else if db.IsDomainAllowPerform(userCred, self, "public") && ownerId.GetProjectId() == userCred.GetProjectId() {
+			} else if db.IsDomainAllowPerform(userCred, self, "public") && ownerId.GetProjectId() == userCred.GetProjectId() && consts.GetNonDefaultDomainProjects() {
+				// only if non_default_domain_projects turned on, share to domain
 				self.SetShare(rbacutils.ScopeDomain)
 			} else {
 				self.SetShare(rbacutils.ScopeNone)
--- a/pkg/compute/models/purge.go
+++ b/pkg/compute/models/purge.go
@@ -1039,20 +1039,6 @@ func (manager *SCloudproviderregionManager) purgeAll(ctx context.Context, userCr
 	return nil
 }

-func (manager *SExternalProjectManager) purgeAll(ctx context.Context, userCred mcclient.TokenCredential, providerId string) error {
-	projs, err := manager.getProjectsByProviderId(providerId)
-	if err != nil {
-		return err
-	}
-	for i := range projs {
-		err = projs[i].Delete(ctx, userCred)
-		if err != nil {
-			return err
-		}
-	}
-	return nil
-}
-
 func (zone *SZone) Purge(ctx context.Context, userCred mcclient.TokenCredential) error {
 	lockman.LockObject(ctx, zone)
 	defer lockman.ReleaseObject(ctx, zone)
--- a/pkg/compute/models/secgroupresource.go
+++ b/pkg/compute/models/secgroupresource.go
@@ -114,6 +114,18 @@ func (manager *SSecurityGroupResourceBaseManager) ListItemFilter(
 		}
 		q = q.Equals("secgroup_id", secgrpObj.GetId())
 	}
+	if len(query.SecgroupName) > 0 {
+		sq := SecurityGroupManager.Query("id").Like("name", "%"+query.SecgroupName+"%")
+		q = q.In("secgroup_id", sq.SubQuery())
+	}
+	if len(query.Project) > 0 {
+		tenant, err := db.TenantCacheManager.FetchTenantByIdOrName(ctx, query.Project)
+		if err != nil {
+			return nil, httperrors.NewResourceNotFoundError2("projects", query.Project)
+		}
+		sq := SecurityGroupManager.Query("id").Equals("tenant_id", tenant.Id)
+		q = q.In("secgroup_id", sq.SubQuery())
+	}
 	return q, nil
 }

--- a/pkg/compute/models/secgrouprules.go
+++ b/pkg/compute/models/secgrouprules.go
@@ -179,13 +179,6 @@ func (manager *SSecurityGroupRuleManager) ListItemFilter(
 	if err != nil {
 		return nil, errors.Wrap(err, "SSecurityGroupResourceBaseManager.ListItemFilter")
 	}
-	/*if defsecgroup := query.Secgroup; len(defsecgroup) > 0 {
-		if secgroup, _ := SecurityGroupManager.FetchByIdOrName(userCred, defsecgroup); secgroup != nil {
-			sql = sql.Equals("secgroup_id", secgroup.GetId())
-		} else {
-			return nil, httperrors.NewNotFoundError("Security Group %s not found", defsecgroup)
-		}
-	}*/
 	if len(query.Direction) > 0 {
 		sql = sql.Equals("direction", query.Direction)
 	}
@@ -195,6 +188,13 @@ func (manager *SSecurityGroupRuleManager) ListItemFilter(
 	if len(query.Protocol) > 0 {
 		sql = sql.Equals("protocol", query.Protocol)
 	}
+	if len(query.Ports) > 0 {
+		sql = sql.Equals("ports", query.Ports)
+	}
+	if len(query.Ip) > 0 {
+		sql = sql.Like("cidr", "%"+query.Ip+"%")
+	}
+
 	return sql, nil
 }

@@ -518,3 +518,20 @@ func (self *SSecurityGroupRule) GetOwnerId() mcclient.IIdentityProvider {
 func (manager *SSecurityGroupRuleManager) ResourceScope() rbacutils.TRbacScope {
 	return rbacutils.ScopeProject
 }
+
+func (manager *SSecurityGroupRuleManager) ListItemExportKeys(ctx context.Context,
+	q *sqlchemy.SQuery,
+	userCred mcclient.TokenCredential,
+	keys stringutils2.SSortedStrings,
+) (*sqlchemy.SQuery, error) {
+	var err error
+	q, err = manager.SResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys)
+	if err != nil {
+		return nil, errors.Wrap(err, "SResourceBaseManager.ListItemExportKeys")
+	}
+	q, err = manager.SSecurityGroupResourceBaseManager.ListItemExportKeys(ctx, q, userCred, keys)
+	if err != nil {
+		return nil, errors.Wrap(err, "SSecurityGroupResourceBaseManager.ListItemExportKeys")
+	}
+	return q, nil
+}
--- a/pkg/compute/models/secgroups.go
+++ b/pkg/compute/models/secgroups.go
@@ -144,12 +144,18 @@ func (manager *SSecurityGroupManager) ListItemFilter(
 		q = q.Filter(sqlchemy.OR(filters...))
 	}

-	if input.IsDirty != nil {
-		if *input.IsDirty {
-			q = q.IsTrue("is_dirty")
-		} else {
-			q = q.IsFalse("is_dirty")
+	if len(input.Ip) > 0 || len(input.Ports) > 0 {
+		sq := SecurityGroupRuleManager.Query("secgroup_id")
+		if len(input.Ip) > 0 {
+			sq = sq.Like("cidr", input.Ip+"%")
 		}
+		if len(input.Ports) > 0 {
+			sq = sq.Equals("ports", input.Ports)
+		}
+		if utils.IsInStringArray(input.Direction, []string{"in", "out"}) {
+			sq = sq.Equals("direction", input.Direction)
+		}
+		q = q.In("id", sq.SubQuery())
 	}

 	return q, nil
@@ -275,19 +281,129 @@ func (manager *SSecurityGroupManager) FetchCustomizeColumns(
 	rows := make([]api.SecgroupDetails, len(objs))

 	virtRows := manager.SSharableVirtualResourceBaseManager.FetchCustomizeColumns(ctx, userCred, query, objs, fields, isList)
-
+	secgroupIds := make([]string, len(objs))
 	for i := range rows {
 		rows[i] = api.SecgroupDetails{
 			SharableVirtualResourceDetails: virtRows[i],
 		}
-		sg := objs[i].(*SSecurityGroup)
-		rows[i].GuestCnt = len(sg.GetGuests())
-		rows[i].CacheCnt, _ = sg.GetSecgroupCacheCount()
-		if !isList {
-			rows[i].Rules = sg.getSecurityRuleString("")
-			rows[i].InRules = sg.getSecurityRuleString("in")
-			rows[i].OutRules = sg.getSecurityRuleString("out")
+		secgroup := objs[i].(*SSecurityGroup)
+		secgroupIds[i] = secgroup.Id
+	}
+
+	caches := []SSecurityGroupCache{}
+	q := SecurityGroupCacheManager.Query().In("secgroup_id", secgroupIds)
+	err := db.FetchModelObjects(SecurityGroupCacheManager, q, &caches)
+	if err != nil {
+		log.Errorf("db.FetchModelObjects error: %v", err)
+		return rows
+	}
+
+	cacheMaps := map[string]int{}
+	for i := range caches {
+		if _, ok := cacheMaps[caches[i].SecgroupId]; !ok {
+			cacheMaps[caches[i].SecgroupId] = 0
 		}
+		cacheMaps[caches[i].SecgroupId]++
+	}
+
+	guests := []SGuest{}
+	q = GuestManager.Query()
+	q = q.Filter(sqlchemy.OR(
+		sqlchemy.In(q.Field("secgrp_id"), secgroupIds),
+		sqlchemy.In(q.Field("admin_secgrp_id"), secgroupIds),
+	))
+	err = db.FetchModelObjects(GuestManager, q, &guests)
+	if err != nil {
+		log.Errorf("db.FetchModelObjects error: %v", err)
+		return rows
+	}
+
+	adminGuestMaps := map[string]int{}
+	systemGuestMaps := map[string]int{}
+	normalGuestMaps := map[string]int{}
+	for i := range guests {
+		if guests[i].IsSystem {
+			if _, ok := systemGuestMaps[guests[i].SecgrpId]; !ok {
+				systemGuestMaps[guests[i].SecgrpId] = 0
+			}
+			systemGuestMaps[guests[i].SecgrpId]++
+		} else {
+			if _, ok := normalGuestMaps[guests[i].SecgrpId]; !ok {
+				normalGuestMaps[guests[i].SecgrpId] = 0
+			}
+			normalGuestMaps[guests[i].SecgrpId]++
+		}
+		if len(guests[i].AdminSecgrpId) > 0 {
+			if _, ok := adminGuestMaps[guests[i].AdminSecgrpId]; !ok {
+				adminGuestMaps[guests[i].AdminSecgrpId] = 0
+			}
+			adminGuestMaps[guests[i].AdminSecgrpId]++
+		}
+	}
+
+	guestSecgroups := []SGuestsecgroup{}
+	q = GuestsecgroupManager.Query().In("secgroup_id", secgroupIds)
+	err = db.FetchModelObjects(GuestsecgroupManager, q, &guestSecgroups)
+	if err != nil {
+		log.Errorf("db.FetchModelObjects error: %v", err)
+		return rows
+	}
+
+	for i := range guestSecgroups {
+		if _, ok := normalGuestMaps[guestSecgroups[i].SecgroupId]; !ok {
+			normalGuestMaps[guestSecgroups[i].SecgroupId] = 0
+		}
+		normalGuestMaps[guestSecgroups[i].SecgroupId]++
+	}
+
+	rules := []SSecurityGroupRule{}
+	q = SecurityGroupRuleManager.Query().In("secgroup_id", secgroupIds)
+	err = db.FetchModelObjects(SecurityGroupRuleManager, q, &rules)
+	if err != nil {
+		log.Errorf("db.FetchModelObjects error: %v", err)
+		return rows
+	}
+	ruleMaps := map[string][]SSecurityGroupRule{}
+	for i := range rules {
+		if _, ok := ruleMaps[rules[i].SecgroupId]; !ok {
+			ruleMaps[rules[i].SecgroupId] = []SSecurityGroupRule{}
+		}
+		ruleMaps[rules[i].SecgroupId] = append(ruleMaps[rules[i].SecgroupId], rules[i])
+	}
+	for i := range rows {
+		rules, ok := ruleMaps[secgroupIds[i]]
+		if !ok {
+			continue
+		}
+		_rules := []api.SSecurityGroupRule{}
+		_inRules := []api.SSecurityGroupRule{}
+		_outRules := []api.SSecurityGroupRule{}
+		for j := range rules {
+			rule := api.SSecurityGroupRule{
+				Id:          rules[j].Id,
+				Priority:    rules[j].Priority,
+				Protocol:    rules[j].Protocol,
+				Ports:       rules[j].Ports,
+				Direction:   rules[j].Direction,
+				CIDR:        rules[j].CIDR,
+				Action:      rules[j].Action,
+				Description: rules[j].Description,
+			}
+			_rules = append(_rules, rule)
+			switch rule.Direction {
+			case secrules.DIR_IN:
+				_inRules = append(_inRules, rule)
+			case secrules.DIR_OUT:
+				_outRules = append(_outRules, rule)
+			}
+		}
+		rows[i].Rules = _rules
+		rows[i].InRules = _inRules
+		rows[i].OutRules = _outRules
+		rows[i].CacheCnt, _ = cacheMaps[secgroupIds[i]]
+		rows[i].GuestCnt, _ = normalGuestMaps[secgroupIds[i]]
+		rows[i].AdminGuestCnt, _ = adminGuestMaps[secgroupIds[i]]
+		rows[i].SystemGuestCnt, _ = systemGuestMaps[secgroupIds[i]]
 	}

 	return rows
--- a/pkg/compute/models/skus_tools.go
+++ b/pkg/compute/models/skus_tools.go
@@ -325,7 +325,7 @@ func SyncElasticCacheSkus(ctx context.Context, userCred mcclient.TokenCredential

 // 同步Region elasticcache sku列表.
 func SyncElasticCacheSkusByRegion(ctx context.Context, userCred mcclient.TokenCredential, region *SCloudregion) error {
-	if region.GetDriver().IsSupportedElasticcache() {
+	if !region.GetDriver().IsSupportedElasticcache() {
 		notes := fmt.Sprintf("SyncElasticCacheSkusByRegion %s not support elasticcache", region.Name)
 		log.Infof(notes)
 		return nil
--- a/pkg/compute/models/snapshotpolicy.go
+++ b/pkg/compute/models/snapshotpolicy.go
@@ -371,6 +371,10 @@ func (sp *SSnapshotPolicy) getMoreDetails(out api.SnapshotPolicyDetails) api.Sna
 	return out
 }

+func (sp *SSnapshotPolicy) GetCloudproviderId() string {
+	return ""
+}
+
 // ==================================================== sync ===========================================================
 func (manager *SSnapshotPolicyManager) SyncSnapshotPolicies(ctx context.Context, userCred mcclient.TokenCredential,
 	provider *SCloudprovider, region *SCloudregion, cloudSPs []cloudprovider.ICloudSnapshotPolicy,
@@ -507,7 +511,7 @@ func (manager *SSnapshotPolicyManager) allNewFromCloudSnapshotPolicy(
 		if err != nil {
 			syncResult.AddError(err)
 		} else {
-			syncMetadata(ctx, userCred, local, added[i])
+			syncVirtualResourceMetadata(ctx, userCred, local, added[i])
 			syncResult.Add()
 		}
 	}
--- a/pkg/compute/models/snapshots.go
+++ b/pkg/compute/models/snapshots.go
@@ -877,7 +877,10 @@ func (manager *SSnapshotManager) newFromCloudSnapshot(ctx context.Context, userC
 	snapshot.ExternalId = extSnapshot.GetGlobalId()
 	var localDisk *SDisk
 	if len(extSnapshot.GetDiskId()) > 0 {
-		disk, err := db.FetchByExternalId(DiskManager, extSnapshot.GetDiskId())
+		disk, err := db.FetchByExternalIdAndManagerId(DiskManager, extSnapshot.GetDiskId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+			sq := StorageManager.Query().SubQuery()
+			return q.Join(sq, sqlchemy.Equals(q.Field("storage_id"), sq.Field("id"))).Filter(sqlchemy.Equals(sq.Field("manager_id"), provider.Id))
+		})
 		if err != nil {
 			log.Errorf("snapshot %s missing disk?", snapshot.Name)
 		} else {
@@ -955,7 +958,7 @@ func (manager *SSnapshotManager) SyncSnapshots(ctx context.Context, userCred mcc
 		if err != nil {
 			syncResult.UpdateError(err)
 		} else {
-			syncMetadata(ctx, userCred, &commondb[i], commonext[i])
+			syncVirtualResourceMetadata(ctx, userCred, &commondb[i], commonext[i])
 			syncResult.Update()
 		}
 	}
@@ -964,7 +967,7 @@ func (manager *SSnapshotManager) SyncSnapshots(ctx context.Context, userCred mcc
 		if err != nil {
 			syncResult.AddError(err)
 		} else {
-			syncMetadata(ctx, userCred, local, added[i])
+			syncVirtualResourceMetadata(ctx, userCred, local, added[i])
 			syncResult.Add()
 		}
 	}
--- a/pkg/compute/models/storagecaches.go
+++ b/pkg/compute/models/storagecaches.go
@@ -173,7 +173,9 @@ func (manager *SStoragecacheManager) SyncWithCloudStoragecache(ctx context.Conte
 	lockman.LockClass(ctx, manager, db.GetLockClassKey(manager, userCred))
 	defer lockman.ReleaseClass(ctx, manager, db.GetLockClassKey(manager, userCred))

-	localCacheObj, err := db.FetchByExternalId(manager, cloudCache.GetGlobalId())
+	localCacheObj, err := db.FetchByExternalIdAndManagerId(manager, cloudCache.GetGlobalId(), func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		return q.Equals("manager_id", provider.Id)
+	})
 	if err != nil {
 		if err == sql.ErrNoRows {
 			localCache, err := manager.newFromCloudStoragecache(ctx, userCred, cloudCache, provider)
--- a/pkg/compute/models/syncutils.go
+++ b/pkg/compute/models/syncutils.go
@@ -25,9 +25,10 @@ import (
 )

 type IMetadataSetter interface {
-	// SetAllMetadata(ctx context.Context, meta map[string]interface{}, userCred mcclient.TokenCredential) error
-	// SetMetadata(ctx context.Context, key string, value interface{}, userCred mcclient.TokenCredential) error
 	SetCloudMetadataAll(ctx context.Context, meta map[string]interface{}, userCred mcclient.TokenCredential) error
+	Keyword() string
+	GetName() string
+	GetCloudproviderId() string
 }

 func syncMetadata(ctx context.Context, userCred mcclient.TokenCredential, model IMetadataSetter, remote cloudprovider.ICloudResource) error {
@@ -50,6 +51,42 @@ func syncMetadata(ctx context.Context, userCred mcclient.TokenCredential, model
 	return nil
 }

+func syncVirtualResourceMetadata(ctx context.Context, userCred mcclient.TokenCredential, model IMetadataSetter, remote cloudprovider.IVirtualResource) error {
+	metaData := remote.GetMetadata()
+	store := make(map[string]interface{}, 0)
+	if metaData != nil {
+		meta := make(map[string]interface{}, 0)
+		err := metaData.Unmarshal(meta)
+		if err != nil {
+			log.Errorf("Get VM Metadata error: %v", err)
+			return err
+		}
+		for key, value := range meta {
+			store[db.CLOUD_TAG_PREFIX+key] = value
+		}
+
+	}
+
+	extProjectId := remote.GetProjectId()
+	if len(extProjectId) > 0 {
+		extProject, err := ExternalProjectManager.GetProject(extProjectId, model.GetCloudproviderId())
+		if err != nil {
+			log.Errorf("sync project metadata for %s %s error: %v", model.Keyword(), model.GetName(), err)
+		} else {
+			store[db.CLOUD_TAG_PREFIX+"project"] = extProject.Name
+		}
+	}
+
+	if len(store) > 0 {
+		model.SetCloudMetadataAll(ctx, store, userCred)
+	}
+	return nil
+}
+
 func SyncMetadata(ctx context.Context, userCred mcclient.TokenCredential, model IMetadataSetter, remote cloudprovider.ICloudResource) error {
 	return syncMetadata(ctx, userCred, model, remote)
 }
+
+func SyncVirtualResourceMetadata(ctx context.Context, userCred mcclient.TokenCredential, model IMetadataSetter, remote cloudprovider.IVirtualResource) error {
+	return syncVirtualResourceMetadata(ctx, userCred, model, remote)
+}
--- a/pkg/compute/models/vpcs.go
+++ b/pkg/compute/models/vpcs.go
@@ -179,11 +179,12 @@ func (manager *SVpcManager) getVpcExternalIdForClassicNetwork(regionId, cloudpro
 	return fmt.Sprintf("%s-%s", regionId, cloudproviderId)
 }

-func (manager *SVpcManager) GetOrCreateVpcForClassicNetwork(host *SHost) (*SVpc, error) {
-	region := host.GetRegion()
-	cloudprovider := host.GetCloudprovider()
+func (manager *SVpcManager) GetOrCreateVpcForClassicNetwork(region *SCloudregion) (*SVpc, error) {
+	cloudprovider := region.GetCloudprovider()
 	externalId := manager.getVpcExternalIdForClassicNetwork(region.Id, cloudprovider.Id)
-	_vpc, err := db.FetchByExternalId(manager, externalId)
+	_vpc, err := db.FetchByExternalIdAndManagerId(manager, externalId, func(q *sqlchemy.SQuery) *sqlchemy.SQuery {
+		return q.Equals("manager_id", region.ManagerId)
+	})
 	if err == nil {
 		return _vpc.(*SVpc), nil
 	}
@@ -199,7 +200,7 @@ func (manager *SVpcManager) GetOrCreateVpcForClassicNetwork(host *SHost) (*SVpc,
 	vpc.SetEnabled(false)
 	vpc.Status = api.VPC_STATUS_UNAVAILABLE
 	vpc.ExternalId = externalId
-	vpc.ManagerId = host.ManagerId
+	vpc.ManagerId = region.ManagerId
 	err = manager.TableSpec().Insert(vpc)
 	if err != nil {
 		return nil, errors.Wrap(err, "Insert vpc for classic network")
@@ -310,19 +311,6 @@ func (manager *SVpcManager) FetchCustomizeColumns(
 	return rows
 }

-func (manager *SVpcManager) getVpcsByRegion(region *SCloudregion, provider *SCloudprovider) ([]SVpc, error) {
-	vpcs := make([]SVpc, 0)
-	q := manager.Query().Equals("cloudregion_id", region.Id)
-	if provider != nil {
-		q = q.Equals("manager_id", provider.Id)
-	}
-	err := db.FetchModelObjects(manager, q, &vpcs)
-	if err != nil {
-		return nil, err
-	}
-	return vpcs, nil
-}
-
 func (self *SVpc) setDefault(def bool) error {
 	var err error
 	if self.IsDefault != def {
@@ -342,7 +330,7 @@ func (manager *SVpcManager) SyncVPCs(ctx context.Context, userCred mcclient.Toke
 	remoteVPCs := make([]cloudprovider.ICloudVpc, 0)
 	syncResult := compare.SyncResult{}

-	dbVPCs, err := manager.getVpcsByRegion(region, provider)
+	dbVPCs, err := region.GetCloudproviderVpcs(provider.Id)
 	if err != nil {
 		syncResult.Error(err)
 		return nil, nil, syncResult
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Zexi Li	4e7af6e2e7	Merge pull request #7227 from ioito/automated-cherry-pick-of-#7224-upstream-release-3.2 Automated cherry pick of #7224: fix: 过滤可用eip	2020-07-17 20:25:04 +08:00
Zexi Li	df8982747a	Merge pull request #7223 from ioito/automated-cherry-pick-of-#7221-upstream-release-3.2 Automated cherry pick of #7221: fix: 避免乌兰察布区域拉取资源异常	2020-07-17 20:24:05 +08:00
Qu Xuan	08c836ad1c	fix: 过滤可用eip	2020-07-17 20:16:54 +08:00
Qu Xuan	5a47ca5da4	fix: 避免乌兰察布区域拉取资源异常	2020-07-17 18:53:20 +08:00
Zexi Li	1e992cc145	Merge pull request #7218 from rainzm/automated-cherry-pick-of-#7216-upstream-release-3.2 Automated cherry pick of #7216: fix: prefetch image error when create guest with vmware template	2020-07-17 10:16:43 +08:00
Zexi Li	1c45f1c6a4	Merge pull request #7215 from tb365/automated-cherry-pick-of-#7213-upstream-release-3.2 Automated cherry pick of #7213: sync classic redis fix	2020-07-17 10:15:54 +08:00
Zexi Li	128bf89ba8	Merge pull request #7205 from yousong/automated-cherry-pick-of-#7202-upstream-release-3.2 Automated cherry pick of #7202: mcclient: options: loadbalanceragents: yum as the default deploy method	2020-07-17 10:15:17 +08:00
Zexi Li	7055459cc0	Merge pull request #7200 from yousong/automated-cherry-pick-of-#7198-upstream-release-3.2 Automated cherry pick of #7198: ansibleserver: register metadata manager	2020-07-17 10:12:02 +08:00
Zexi Li	f0a65e5b5f	Merge pull request #7197 from ioito/automated-cherry-pick-of-#7195-upstream-release-3.2 Automated cherry pick of #7195: fix: sec rule export missing fields	2020-07-17 10:10:42 +08:00
Zexi Li	34c865ce22	Merge pull request #7191 from ioito/automated-cherry-pick-of-#7077-upstream-release-3.2 Automated cherry pick of #7077: fix: 修复elastic cache sku zone_id异常问题	2020-07-17 10:09:57 +08:00
Zexi Li	51911362ab	Merge pull request #7194 from wanyaoqi/automated-cherry-pick-of-#7192-upstream-release-3.2 Automated cherry pick of #7192: add params auto_migrate_on_host_down	2020-07-17 10:09:14 +08:00
Zexi Li	28c6abd0e8	Merge pull request #7212 from ioito/automated-cherry-pick-of-#7210-upstream-release-3.2 Automated cherry pick of #7210: fix: not work for network-list --zones	2020-07-17 10:08:22 +08:00
rainzm	d3c1bfd21d	fix: prefetch image error when create guest with vmware template 1. Only need the corresponding vmware template in the vcenter where the host is located. 2. Chose storagecache which cacheimage is ready before deploying.	2020-07-16 21:44:26 +08:00
tangbin	df2deb61c4	update vendor	2020-07-16 20:39:35 +08:00
tangbin	38be2488be	sync classic redis fix	2020-07-16 20:34:09 +08:00
yunion-ci-robot	c781346225	Merge pull request #7206 from zexi/automated-cherry-pick-of-#7201-upstream-release-3.2 Automated cherry pick of #7201: webconsole: fix old session make new session closed	2020-07-16 20:21:20 +08:00
Qu Xuan	60ba1ffc20	fix: not work for network-list --zones	2020-07-16 19:06:37 +08:00
Yousong Zhou	87bba5ae4f	region: lbagents: turn off guest src check	2020-07-16 18:50:36 +08:00
Yousong Zhou	836ac8e00e	region: loadbalanceragents: yum as the default method	2020-07-16 18:50:36 +08:00
Yousong Zhou	4bdf62cb81	mcclient: options: loadbalanceragents: yum as the default deploy method	2020-07-16 18:50:36 +08:00
Zexi Li	1d2b64d62e	webconsole: fix old session make new session closed	2020-07-16 18:50:29 +08:00
Yousong Zhou	67230151a0	build: ansibleserver: use native alpine, include openssh	2020-07-16 18:12:41 +08:00
Yousong Zhou	08b60b4c6f	ansibleserver: register metadata manager To quash the following error in log [E 200716 15:20:40 db.(*SMetadataResourceBaseModelManager).FetchCustomizeColumns(metadataresource.go:136)] FetchQueryObjectsByIds metadata fail Error 1146: Table 'yunionansible.metadata_tbl' doesn't exist	2020-07-16 18:10:38 +08:00
Qu Xuan	9e81cae902	fix: sec rule export missing fields	2020-07-16 17:14:44 +08:00
Qu Xuan	020f3dee57	fix: 修复elastic cache sku zone_id异常问题	2020-07-16 16:32:08 +08:00
wanyaoqi	4ab5051c04	add params auto_migrate_on_host_down	2020-07-16 15:08:33 +08:00
Zexi Li	e39ce07331	Merge pull request #7176 from ioito/automated-cherry-pick-of-#7174-upstream-release-3.2 Automated cherry pick of #7174: fix: 添加secgroup rule过滤参数	2020-07-16 11:18:55 +08:00
Zexi Li	3259b1b2c4	Merge pull request #7190 from ioito/automated-cherry-pick-of-#7188-upstream-release-3.2 Automated cherry pick of #7188: fix: check azure image format when rebuild root	2020-07-16 11:09:51 +08:00
Zexi Li	2934f6c15b	Merge pull request #7179 from ioito/automated-cherry-pick-of-#7177-upstream-release-3.2 Automated cherry pick of #7177: fix: 避免华为云安全组规则删除失败	2020-07-16 10:16:35 +08:00
Qu Xuan	84c7341b7f	fix: check azure image format when rebuild root	2020-07-15 18:48:25 +08:00
Zexi Li	5cff334188	Merge pull request #7183 from wanyaoqi/automated-cherry-pick-of-#7181-upstream-release-3.2 Automated cherry pick of #7181: misc ha guest fix	2020-07-15 17:42:40 +08:00
Qu Xuan	987ba6079b	fix: 避免华为云安全组规则删除失败	2020-07-15 17:14:21 +08:00
wanyaoqi	60df899d5d	misc ha guest fix	2020-07-15 17:06:43 +08:00
Qu Xuan	39c033e0c5	fix: 添加secgroup rule过滤参数	2020-07-15 14:32:24 +08:00
Zexi Li	01908aebdb	Merge pull request #7170 from wanyaoqi/automated-cherry-pick-of-#7168-upstream-release-3.2 Automated cherry pick of #7168: fix list guests on host	2020-07-15 10:46:03 +08:00
Zexi Li	472a2f9ebb	Merge pull request #7154 from yousong/bugfix/yousong-vpcagent-mtu3.2 vpcagent: ovn: set underlay mtu size in config file	2020-07-15 10:35:28 +08:00
Zexi Li	4919226d0d	Merge pull request #7160 from yousong/automated-cherry-pick-of-#7158-upstream-release-3.2 Automated cherry pick of #7158: iproute2: address: make Exact idempotent	2020-07-15 10:34:41 +08:00
Zexi Li	769dd28a51	Merge pull request #7164 from tb365/automated-cherry-pick-of-#7163-upstream-release-3.2 Automated cherry pick of #7163: cloudprovider usable filter with zone	2020-07-15 10:34:03 +08:00
wanyaoqi	2b7373608d	fix list guests on host	2020-07-14 22:36:55 +08:00
tangbin	6a81f78a4d	cloudprovider usable filter with zone	2020-07-14 19:55:05 +08:00
Zexi Li	05d5bd6c9f	Merge pull request #7157 from ioito/automated-cherry-pick-of-#7155-upstream-release-3.2 Automated cherry pick of #7155: fix: 优化webconsole代码&bugfix	2020-07-14 17:53:08 +08:00
Yousong Zhou	48000786cc	iproute2: address: make Exact idempotent Idempotence against address not available for Exact is not a bad idea if we look at the name of that func This should accomodate the race condition where keepalived will remove vips should the primary address used for vrrp comms is removed, causing later addr del to fail with "cannot assign requested address"	2020-07-14 16:42:18 +08:00
Qu Xuan	fae1c3d542	fix: 优化webconsole代码&bugfix	2020-07-14 15:09:35 +08:00
Yousong Zhou	ba87528561	vpcagent: ovn: set underlay mtu size in config file (cherry picked from commit `2841e245e2`)	2020-07-14 11:38:21 +08:00
Zexi Li	03d393cca4	Merge pull request #7149 from rainzm/automated-cherry-pick-of-#7147-upstream-release-3.2 Automated cherry pick of #7147: fix: mo.VirtualMachine's Config maybe nil	2020-07-14 11:34:47 +08:00
rainzm	51131f9c75	fix: mo.VirtualMachine's Config maybe nil	2020-07-13 23:11:02 +08:00
Zexi Li	b7b5e5666e	Merge pull request #7136 from tb365/automated-cherry-pick-of-#7135-upstream-release-3.2 Automated cherry pick of #7135: user batch register bugfix	2020-07-13 21:28:58 +08:00
Zexi Li	3c9ca461d9	Merge pull request #7142 from ioito/automated-cherry-pick-of-#7140-upstream-release-3.2 Automated cherry pick of #7140: fix: 修复阿里云同步安全组规则异常问题	2020-07-13 21:24:36 +08:00
Qu Xuan	f874a02c05	fix: 修复阿里云同步安全组规则异常问题	2020-07-13 20:48:18 +08:00
tangbin	f7b31c08cb	user batch register bugfix	2020-07-13 14:49:20 +08:00
Zexi Li	08c2864b71	Merge pull request #7127 from wanyaoqi/automated-cherry-pick-of-#7125-upstream-release-3.2 Automated cherry pick of #7125: - fix local storage init local man	2020-07-10 20:15:49 +08:00
wanyaoqi	b25e4dfb31	- fix local storage init local man - fix rbd set storage info	2020-07-10 14:49:35 +08:00
Zexi Li	35cdcbe0ff	Merge pull request #7118 from ioito/automated-cherry-pick-of-#7116-upstream-release-3.2 Automated cherry pick of #7116: fix: 修复vpc同步异常问题	2020-07-09 21:23:17 +08:00
Zexi Li	8e440f9390	Merge pull request #7115 from ioito/automated-cherry-pick-of-#7113-upstream-release-3.2 Automated cherry pick of #7113: fix: 避免越界访问	2020-07-09 21:21:24 +08:00
Zexi Li	40a903a56f	Merge pull request #7108 from wanyaoqi/automated-cherry-pick-of-#7106-upstream-release-3.2 Automated cherry pick of #7106: fix set storage info bind mount	2020-07-09 21:19:39 +08:00
Qu Xuan	2d4d76cdd6	fix: 修复vpc同步异常问题	2020-07-09 21:13:36 +08:00
Qu Xuan	3e2eeb9e6e	fix: 避免越界访问	2020-07-09 20:25:11 +08:00
wanyaoqi	447f41a40f	fix set storage info bind mount	2020-07-09 14:55:44 +08:00
Zexi Li	95f59d0a59	Merge pull request #7104 from swordqiu/automated-cherry-pick-of-#7102-upstream-release-3.2 Automated cherry pick of #7102: fix: opslog show the owners operation logs only	2020-07-09 14:24:13 +08:00
Qiu Jian	40ee6d6d44	fix: opslog show the owners operation logs only	2020-07-09 11:27:01 +08:00
Zexi Li	f978973c7e	Merge pull request #7095 from ioito/automated-cherry-pick-of-#7093-upstream-release-3.2 Automated cherry pick of #7093: fix: 修复资源组云上同步异常问题	2020-07-08 21:24:30 +08:00
Qu Xuan	8f5634eafc	fix: 修复资源组云上同步异常问题	2020-07-08 16:26:26 +08:00
Zexi Li	eda171ced0	Merge pull request #7081 from ioito/automated-cherry-pick-of-#7079-upstream-release-3.2 Automated cherry pick of #7079: fix: 修复腾讯云操作日志时间异常问题	2020-07-08 14:09:39 +08:00
Zexi Li	c3a81ca793	Merge pull request #7090 from ioito/automated-cherry-pick-of-#7088-upstream-release-3.2 Automated cherry pick of #7088: fix: 修复azure 项目同步问题	2020-07-08 01:38:24 +08:00
Qu Xuan	abfa4a5a4d	fix: 修复azure 项目同步问题	2020-07-07 18:48:31 +08:00
Qu Xuan	e77eb6e8ba	fix: 修复腾讯云操作日志时间异常问题	2020-07-07 14:59:19 +08:00
Zexi Li	9d35818660	Merge pull request #7070 from swordqiu/automated-cherry-pick-of-#6880-upstream-release-3.2 Automated cherry pick of #6880: feature: 1. allow enable/disable idp-synced-users 2. turn off user's MFA by default	2020-07-07 14:51:45 +08:00
Zexi Li	fe28b8d6c6	Merge pull request #7073 from ioito/automated-cherry-pick-of-#7066-upstream-release-3.2 Automated cherry pick of #7066: fix: json request 支持自定义匹配err	2020-07-07 14:46:56 +08:00
Zexi Li	bccc16c4c5	Merge pull request #7053 from ioito/automated-cherry-pick-of-#7050-upstream-release-3.2 Automated cherry pick of #7050: fix: google rds regional and zonal	2020-07-07 14:45:51 +08:00
Zexi Li	8f3a9fe611	Merge pull request #7076 from ioito/automated-cherry-pick-of-#7074-upstream-release-3.2 Automated cherry pick of #7074: fix: 分开统计安全组关联虚拟机数量	2020-07-07 14:43:39 +08:00
Qu Xuan	dce47bbb22	fix: 分开统计安全组关联虚拟机数量	2020-07-07 11:49:52 +08:00
Qu Xuan	15a809e744	fix: json request 支持自定义匹配err	2020-07-07 11:18:32 +08:00
Zexi Li	ba7af63d59	Merge pull request #7063 from rainzm/automated-cherry-pick-of-#7061-upstream-release-3.2 Automated cherry pick of #7061: Update docker image onecloud-base and its references	2020-07-07 11:12:51 +08:00
Qiu Jian	c808ca89e6	remove mfa/totp modification on 3.2	2020-07-07 01:21:22 +08:00
Qiu Jian	d2b28e04c9	feature: 1. allow enable/disable idp-synced-users 2. turn off user's MFA by default	2020-07-07 01:19:14 +08:00
rainzm	b9908acaae	Update docker image onecloud-base and its references	2020-07-06 21:04:45 +08:00
Qu Xuan	fec72492b7	fix: google rds regional and zonal	2020-07-06 11:18:52 +08:00
Zexi Li	1a0974ae83	Merge pull request #7044 from swordqiu/automated-cherry-pick-of-#7042-upstream-release-3.2 Automated cherry pick of #7042: feature: project filter that list jointable projects for user or group	2020-07-04 12:11:45 +08:00
Zexi Li	51197b837f	Merge pull request #7033 from ioito/automated-cherry-pick-of-#7031-upstream-release-3.2 Automated cherry pick of #7031: fix: 避免azure同步资源组异常	2020-07-04 12:10:50 +08:00
Zexi Li	dcfa17492b	Merge pull request #7038 from swordqiu/automated-cherry-pick-of-#7036-upstream-release-3.2 Automated cherry pick of #7036: fix: cloud account sync may block	2020-07-04 12:09:28 +08:00
Qiu Jian	b982ff47f3	feature: project filter that list jointable projects for user or group	2020-07-04 11:35:47 +08:00
Qiu Jian	d9035e9cba	fix: cloud account sync may block	2020-07-04 10:24:24 +08:00
Qu Xuan	c4f14c7f42	fix: 避免azure同步资源组异常	2020-07-03 20:57:52 +08:00
Zexi Li	60bcb757fb	Merge pull request #7011 from ioito/automated-cherry-pick-of-#7009-upstream-release-3.2 Automated cherry pick of #7009: fix: 取消aliyun lb scheduler创建限制	2020-07-03 19:24:49 +08:00
Zexi Li	40bffa5d12	Merge pull request #7022 from ioito/automated-cherry-pick-of-#7020-upstream-release-3.2 Automated cherry pick of #7020: fix: 优化安全组list速度，并发挥rule规则信息	2020-07-03 17:39:40 +08:00
Qu Xuan	22e7aa2f79	fix: 优化安全组list速度，并发挥rule规则信息	2020-07-03 15:53:26 +08:00
yunion-ci-robot	b34f6dbd8c	Merge pull request #7001 from tb365/automated-cherry-pick-of-#7000-upstream-release-3.2 Automated cherry pick of #7000: cluster_d required->optional	2020-07-02 20:29:27 +08:00
Zexi Li	fdc918a0ee	Merge pull request #7005 from ioito/automated-cherry-pick-of-#6998-upstream-release-3.2 Automated cherry pick of #6998: fix: manager_id资源隔离获取	2020-07-02 20:20:23 +08:00
Zexi Li	7609ef53df	Merge pull request #7008 from wanyaoqi/automated-cherry-pick-of-#7006-upstream-release-3.2 Automated cherry pick of #7006: bind mount nfs storage path	2020-07-02 17:35:30 +08:00
Qu Xuan	ee173b3397	fix: 取消aliyun lb scheduler创建限制	2020-07-02 15:44:42 +08:00
wanyaoqi	4e22ff4805	bind mount nfs storage path	2020-07-02 14:35:13 +08:00
Qu Xuan	aaa3d498a5	fix: manager_id资源隔离获取	2020-07-02 14:30:18 +08:00
tangbin	a2bcbb83cd	cluster_d required->optional	2020-07-02 11:54:39 +08:00
Zexi Li	068662e36e	Merge pull request #6992 from rainzm/automated-cherry-pick-of-#6990-upstream-release-3.2 Automated cherry pick of #6990: fix the bug introduced in #6643	2020-07-01 19:26:32 +08:00
rainzm	9c141930c2	fix the bug introduced in #6643	2020-07-01 16:54:28 +08:00
Zexi Li	d27574e832	Merge pull request #6969 from ioito/automated-cherry-pick-of-#6903-upstream-release-3.2 Automated cherry pick of #6903: fix: 修正项目映射同步	2020-07-01 16:30:02 +08:00
Zexi Li	8641803302	Merge pull request #6977 from wanyaoqi/automated-cherry-pick-of-#6975-upstream-release-3.2 Automated cherry pick of #6975: fix deploy backup server order	2020-06-30 23:09:03 +08:00
wanyaoqi	6feeff2009	fix deploy backup server order	2020-06-30 22:03:51 +08:00
Qu Xuan	60cdc3fdda	fix: 支持同步project标签到本地资源	2020-06-30 14:08:49 +08:00
Qu Xuan	6bed7639b0	fix: 修正项目映射同步	2020-06-30 11:52:41 +08:00
Zexi Li	aa9a5896c8	Merge pull request #6949 from swordqiu/automated-cherry-pick-of-#6947-upstream-release-3.2 Automated cherry pick of #6947: fix: disable domain sharing if non_default_domain_projects turned off	2020-06-30 10:48:22 +08:00
Qiu Jian	24f4b91955	fix: disable domain sharing if non_default_domain_projects turned off	2020-06-28 13:26:31 +08:00
Zexi Li	185c780faf	Merge pull request #6945 from yousong/automated-cherry-pick-of-#6943-upstream-release-3.2 Automated cherry pick of #6943: lb: include cluster name info in details	2020-06-28 09:01:44 +08:00
Yousong Zhou	b3588b48a2	lb: include cluster name info in details	2020-06-24 18:55:51 +08:00
Zexi Li	98a0d39a0a	Merge pull request #6935 from wanyaoqi/automated-cherry-pick-of-#6933-upstream-release-3.2 Automated cherry pick of #6933: server name enable upper case	2020-06-24 17:42:27 +08:00
Zexi Li	f7fde18f46	Merge pull request #6920 from ioito/automated-cherry-pick-of-#6918-upstream-release-3.2 Automated cherry pick of #6918: fix: 避免azure同步项目失败	2020-06-24 12:58:40 +08:00
Zexi Li	0cb69b7fb6	Merge pull request #6928 from ioito/automated-cherry-pick-of-#6926-upstream-release-3.2 Automated cherry pick of #6926: fix: google资源名称兼容处理	2020-06-23 23:29:39 +08:00
Zexi Li	8637b1fa04	Merge pull request #6938 from swordqiu/automated-cherry-pick-of-#6936-upstream-release-3.2 Automated cherry pick of #6936: fix: sort quota list result by usage rate	2020-06-23 23:28:02 +08:00
Qiu Jian	9a6362cd6b	fix: sort quota list result by usage rate	2020-06-23 22:24:00 +08:00
Zexi Li	e0b523ba65	Merge pull request #6923 from swordqiu/automated-cherry-pick-of-#6921-upstream-release-3.2 Automated cherry pick of #6921: fix: simplify forbidden user login message	2020-06-23 21:26:03 +08:00
wanyaoqi	74037b56ca	server name enable upper case	2020-06-23 21:07:16 +08:00
Qu Xuan	a898351061	fix: google资源名称兼容处理	2020-06-23 20:30:54 +08:00
Qiu Jian	21f1486001	fix: simplify forbidden user login message	2020-06-23 17:47:49 +08:00
Qu Xuan	8ec7fd93dc	fix: 避免azure同步项目失败	2020-06-23 17:32:49 +08:00
Zexi Li	f3b2f3d93e	Merge pull request #6905 from wanyaoqi/automated-cherry-pick-of-#6904-upstream-release-3.2 Automated cherry pick of #6904: fix get storage capabilities with null field	2020-06-23 11:53:31 +08:00
Zexi Li	a75554ed40	Merge pull request #6916 from ioito/automated-cherry-pick-of-#6912-upstream-release-3.2 Automated cherry pick of #6912: optimized: 支持ip和端口过滤安全组	2020-06-23 11:52:32 +08:00
Qu Xuan	3452b85d69	optimized: 支持ip和端口过滤安全组	2020-06-23 11:26:37 +08:00
yunion-ci-robot	ef47ad9807	Merge pull request #6908 from wanyaoqi/automated-cherry-pick-of-#6906-upstream-release-3.2 Automated cherry pick of #6906: disable dhclient	2020-06-22 23:42:03 +08:00
wanyaoqi	063ac404f0	disable dhclient	2020-06-22 21:30:53 +08:00
wanyaoqi	1425da2ccd	fix get storage capabilities with null field	2020-06-22 20:00:15 +08:00
Zexi Li	c857ca4410	Merge pull request #6895 from yousong/automated-cherry-pick-of-#6893-upstream-release-3.2 Automated cherry pick of #6893: cloudcommon: app: cosmetic change	2020-06-22 09:15:33 +08:00
Yousong Zhou	8bb60ea439	cloudcommon: policy: fix interval and oneshot sync Reduce CPU utilization caused by queued time.AfterFunc calls	2020-06-21 18:34:00 +08:00
Yousong Zhou	f59f5cb4bf	cloudcommon: app: cosmetic change	2020-06-21 18:34:00 +08:00