noironetworks / aci-containers / 11641

63%

master: 63%

Build Type

Pull #1675

travis-pro

Committed by jeffinkottaram

Commit Message

Prevent cross-controller deletes in multi-cluster APIC

In  multi-cluster deployments, avoid acting on objects that are not
owned by current instance.

- Filter websocket notifications under the configured vrfTenant by
  controller prefix when DN-based filtering is possible, and bypass the
  filter for subscriptions with update/delete hooks.
- Before deleting an APIC object from handleQueuedDn(), GET the MO and
  verify tagAnnotation matches the controller sync-tag prefix; skip
  deletion when the tag is missing or owned by another controller.

This prevents a race where subscription notifications could previously
enter the controller-initiated delete path and remove objects created
manually or managed by other controllers.

(cherry picked from commit 6680bbf7f)

Pull Request Pull Request #1675: Prevent cross-controller deletes in multi-cluster APIC

Run Details

63 of 89 new or added lines in 3 files covered. (70.79%)

12 existing lines in 3 files now uncovered.

13490 of 21466 relevant lines covered (62.84%)

0.72 hits per line