noironetworks / aci-containers / 12029

64%

master: 64%

Build Type

push

travis-pro

Committed by Santosh-oc

Commit Message

fix(apicapi): block helper-MO deletes using tag-based ownership

Reproduction:
During SNAT policy churn, the controller repeatedly attempts to DELETE
APIC-managed child relation MOs owned by APIC. APIC rejects these
with HTTP 400 "Invalid access", causing the websocket connection to
close and the controller to enter a reconnect loop.

Root cause:
When an SNAT policy is deleted and immediately recreated, APIC
generates helper reverse-relation children under the newly created
service graph objects. When the delete and create notifications arrive
in quick succession, the reconcile cycle triggered by the create
notification fetches a subtree snapshot that already contains these
APIC-managed helper children. Because the parent object carries a
controller sync tagAnnotation, the helper children inherit the parent
tag in the subtree response and are mistakenly treated as
controller-owned. Reconcile then queues DELETE requests for them. APIC
rejects those DELETEs with HTTP 400 "Invalid access", which closes the
websocket connection and triggers a reconnect loop.

Fix:
Introduce a hasLocalSyncTag() helper that determines controller
ownership at the object level rather than by inheriting parent context.
It returns true only when the object itself carries a tagAnnotation
child with key aci-containers-controller-tag, a value matching the
controller sync tag prefix, and an annotation DN that is local to the
object's own DN.

All delete decision points in apicObjCmp, diffApicState, and
reconcileApicObject now gate deletes on hasLocalSyncTag(). APIC-managed
helper children that appear in the subtree but do not have their own
local annotation fail this check and are skipped. Legitimate
controller-owned objects that were written with their own tagAnnotation
continue to be deleted as expected.

Coverage Stats

32 of 39 new or added lines in 1 file covered. (82.05%)

1 existing line in 1 file now uncovered.

13696 of 21390 relevant lines covered (64.03%)

0.73 hits per line