noironetworks / aci-containers / 11634

63%

master: 63%

Build Type

push

travis-pro

Committed by jeffinkottaram

Commit Message

Prevent deletion of APIC objects not owned by this controller

This commit adds tag-based ownership verification before deleting APIC objects,
preventing accidental deletion of resources managed by other controllers or
created manually.

Changes:

1. Add isOwnedByController() to verify sync tag before deletion
   - Fetches object from APIC with tagAnnotation child
   - Checks if tag matches controller's prefix pattern
   - Returns false if object doesn't exist or lacks controller's tag
   - Protects against race conditions in subscription notification callbacks

2. Introduce pendingChangeSyncDelete for sync-initiated deletions
   - Sync/reconcile operations already verify ownership before queueing deletes
   - Bypass redundant GET request by using pendingChangeSyncDelete kind
   - Subscription-triggered deletes without desired state still check ownership

3. Optimize websocket notification filtering
   - Probe AciNameForKey at initialization to detect prefix embedding behavior
   - Filter notifications under vrfTenant lacking controller's prefix
   - Bypass filter for subscriptions with hooks (e.g., fvSubnet tracking all BDs)
   - Use inline string concatenation instead of pre-computed fields

This fix addresses incorrect deletion of resources in multi-controller and
manually-managed scenarios while maintaining performance through intelligent
filtering and eliminating redundant APIC lookups where ownership is already known.

Run Details

63 of 89 new or added lines in 3 files covered. (70.79%)

3 existing lines in 2 files now uncovered.

13495 of 21466 relevant lines covered (62.87%)

0.72 hits per line