affinity: make the host-tag affinity group admin-controlled

Host tags are set by the operator, so a group whose name is used as a host
tag should be admin-controlled too. Override isAdminControlledGroup() to true
(as ExplicitDedication does) so a non-admin cannot create a group named after
an operator tag to bias their VMs onto those hosts.

Author: rootnomad

plugins/affinity-group-processors/host-tag-affinity/src/main/java/org/apache/cloudstack/affinity/HostTagAffinityProcessor.java

@@ -37,7 +37,7 @@
 /**
  * Soft VM-to-host placement preference: the affinity group name is treated as a host tag, and hosts
  * carrying that tag in the VM's zone have their deployment priority raised. A preference, not a
- * constraint — no host is excluded. Note: the priority channel is not honored by automatic DRS.
+ * constraint, so no host is excluded. Note: the priority channel is not honored by automatic DRS.
  */
 public class HostTagAffinityProcessor extends AffinityProcessorBase implements AffinityGroupProcessor {
 
@@ -60,6 +60,11 @@ public void process(VirtualMachineProfile vmProfile, DeploymentPlan plan, Exclud
         }
     }
 
+    @Override
+    public boolean isAdminControlledGroup() {
+        return true;
+    }
+
     protected void processAffinityGroup(AffinityGroupVMMapVO vmGroupMapping, DeploymentPlan plan, VirtualMachine vm) {
         AffinityGroupVO group = affinityGroupDao.findById(vmGroupMapping.getAffinityGroupId());
         if (group == null || StringUtils.isBlank(group.getName())) {

plugins/affinity-group-processors/host-tag-affinity/src/test/java/org/apache/cloudstack/affinity/HostTagAffinityProcessorTest.java

@@ -132,4 +132,10 @@ public void testCheckAlwaysTrue() throws Exception {
         // A soft preference must never fail a planned destination.
         Assert.assertTrue(processor.check(Mockito.mock(VirtualMachineProfile.class), Mockito.mock(DeployDestination.class)));
     }
+
+    @Test
+    public void testGroupIsAdminControlled() {
+        // Host tags are operator-set, so this group type is admin-controlled.
+        Assert.assertTrue(processor.isAdminControlledGroup());
+    }
 }