noironetworks / aci-containers / 11635

63%

master: 63%

Build Type

push

travis-pro

Committed by jeffinkottaram

Commit Message

Prevent cross-controller deletes in multi-cluster APIC

In multi-controller / multi-cluster APIC deployments, avoid acting on
objects that are not owned by current instance.

- Filter websocket notifications under the configured vrfTenant by
  controller prefix when DN-based filtering is possible, and bypass the
  filter for subscriptions with update/delete hooks.
- Before deleting an APIC object from handleQueuedDn(), GET the MO and
  verify tagAnnotation matches the controller sync-tag prefix; skip
  deletion when the tag is missing or owned by another controller.

This prevents a race where subscription notifications could previously
enter the controller-initiated delete path and remove objects created
manually or managed by other controllers.

Run Details

63 of 89 new or added lines in 3 files covered. (70.79%)

4 existing lines in 1 file now uncovered.

13497 of 21466 relevant lines covered (62.88%)

0.72 hits per line