Troubleshooting Multi-Admin Approval
Troubleshooting
This page lists the messages you may see while working with Multi-Admin Approval, what each one means, and what to do. It ends with answers to common questions about how the workflow behaves.
When a request is refused
"Cannot perform this action because it affects entities which are related to an ongoing pending action."
The object you're trying to change is part of a request that's still waiting for approval. While a pending action is open, the objects in it are locked against other changes, so reviewers approve exactly the operation that will run. The message continues: "An administrator may find it under Administration > Action Policies > Pending Actions."
What to do: Find the pending action (see Pending Actions) and get it approved, or cancel it. Once it completes or is cancelled, the lock is released and you can make your change.
"Cannot perform this action because it is being enforced by an action policy with pending changes."
The operation you requested is governed by an action policy, and a change to that policy is itself waiting for approval. New requests under the policy are declined until the policy change is settled, so every request is reviewed under an agreed policy.
What to do: Ask the reviewers to approve (or cancel) the pending change to the policy, then submit your request again.
"Action policy of type "Snapshot scheduler" blocks this operation."
You tried to delete a snapshot that the snapshot scheduler created. While a Snapshot scheduler Edit policy exists, scheduled snapshots are immutable for every user and every interface.
What to do: Nothing. The scheduler removes the snapshot itself when its retention period ends. Snapshots taken manually aren't covered and can still be deleted. See Multi-Admin Approval.
When approving, declining, or cancelling
"This user already sent/approved this action. Need other admin/s approval."
You've already approved this pending action. If you started the request and you're an authorized reviewer, your request already counted as the first approval, so you can't approve it a second time.
What to do: Another authorized reviewer needs to approve it.
"This user is not an authorized reviewer."
Only the administrators named as authorized reviewers on the policy that governs the request can approve or decline it.
What to do: Ask one of the authorized reviewers, or have an Admin add you to the policy's reviewers (see Action Policies).
"This user already declined this action."
You've already declined this request. You can still change your mind by approving it, which replaces your decline.
"Pending action n does not exist."
The ID doesn't match an open pending action. It may have been approved and completed, or cancelled, since you listed the actions.
What to do: List the pending actions again to find the current ID.
"You do not have permissions to delete this pending action."
Users who aren't Admins can only cancel pending actions that they started themselves.
What to do: Ask an Admin to cancel it.
"Pending action n was fully approved, but it is declined by user/s: names, therefore it cannot be performed yet."
The request has enough approvals, but at least one reviewer has declined it, and one decline is enough to hold it.
What to do: Talk to the reviewer who declined. They can approve the request, which replaces their decline and lets it run, or an Admin can cancel the request. See Pending Actions.
When creating, editing, or deleting policies
"Action policy is already configured for: entity type operation"
Each entity type and operation combination can have only one policy.
What to do: Edit the existing policy instead (action_policies edit), or delete it and create a new one.
"Action Policy of type "entity type operation" is currently not supported" / "Wrong EntityType provided" / "Wrong OperationType provided"
The entity type or operation type you entered isn't one of the supported combinations: Volume Delete, Snapshot scheduler Edit, and Action Policy with Create, Edit, or Delete.
"Wrong amount of admins provided. It must be a valid integer greater than 1"
The minimum number of required reviewers must be at least 2.
"Wrong amount of authorized reviewers provided. It must be at least as many admins you specified"
You named fewer reviewers than the number of approvals you require. A policy can't ask for more approvals than it has reviewers.
"Only admin accounts can be authorized reviewers."
One of the users you named doesn't have the Admin role. Reviewers must be Admins.
"Cannot delete action policy id=n because it is associated to an existing pending action, which has to be deleted first."
A policy can't be deleted while a request under it is still pending.
What to do: Resolve or cancel the pending action first (see Pending Actions), then delete the policy.
Questions
Reviewers aren't getting the email.
StorONE emails every authorized reviewer once, when the pending action is created, using the email address on each reviewer's user account and the system's mail server settings (see Notifications). If the email can't be sent, no error is shown and it isn't sent again. The request is still there: reviewers can find it under Administration > Action Policies > Pending Actions, or with action_policies pending_actions list --waitingForMyReview. Check the mail server settings so future requests reach people, and give each reviewer a valid email address.
I ran a delete and nothing was deleted.
That's expected when a Volume Delete policy exists. The request became a pending action, and nothing is applied until enough reviewers approve it. List the pending actions to see it.
Can the person who starts a request approve it?
Can a reviewer change their decision?
Yes. Approving removes your decline, and declining removes your approval.
Do pending actions expire?
No. They stay open until they're approved and run, or cancelled.
How do I stop a request that shouldn't go ahead?
See also: Pending Actions · Action Policies · Best practices