kubeovn / kube-ovn / 27194249053

25%

master: 27%

push

github

fix(controller): skip orphaned subnet instead of breaking namespace subnet loop (#6836)

* fix(controller): skip orphaned subnet instead of breaking namespace subnet loop

In handleAddNamespace, when a subnet references a non-existent VPC the
code logged "ignoring subnet" but executed `break`, which terminated the
entire `for _, s := range subnets` loop rather than skipping just the
broken subnet. Since the lister iteration order is non-deterministic, any
valid subnet returned after an orphaned one was never evaluated for
namespace binding, leaving the namespace with incomplete or wrong
logical-switch/cidr/exclude-ips annotations. New pods in that namespace
could then land on the wrong subnet (or fall back to the default subnet),
breaking network isolation.

Replace `break` with `continue` so only the broken subnet is skipped and
the loop keeps evaluating the remaining subnets, matching the intent of
the surrounding "we just ignore it" comment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

* test(controller): cover orphaned-subnet handling in handleAddNamespace

Add a regression test asserting that a subnet referencing a non-existent
VPC does not abort evaluation of the remaining subnets, so a valid subnet
returned by the lister after the orphaned one is still bound to the
namespace regardless of the (random) lister iteration order.

Wire ippoolLister and nsKeyMutex into the fake controller harness so the
namespace handler can run under test.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>

---------

Signed-off-by: Mengxin Liu <liumengxinfly@gmail.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
(cherry picked from commit 9194883e1)

3 of 3 new or added lines in 1 file covered. (100.0%)

14281 of 56738 relevant lines covered (25.17%)

0.29 hits per line