noironetworks / aci-containers / 12038

64%

master: 64%

Build Type

Pull #1741

travis-pro

Committed by burhan20

Commit Message

Fix(apicapi): prevent invalid delete of APIC owned helper MOs

Reproduction:
During SNAT policy churn, the controller repeatedly attempts to DELETE
APIC-managed child relation MOs owned by APIC. APIC rejects these
with HTTP 400 "Invalid access", causing the websocket connection to
close and the controller to enter a reconnect loop.

Root cause:
When an SNAT policy is deleted and immediately recreated, APIC
helper reverse-relation children can appear under service graph
objects during reconcile. In the reconcile path, existing APIC objects
are compared against desired state, and extra current children are
added to delete candidates.

For helper relation classes that are not present in metadata,
checkNonDeletable() defaults to deletable=true. Those relation MOs are then
added to the delete list and queued to APIC. APIC rejects direct
deletion of these reverse-relation MOs with HTTP 400 "Invalid access",
which can close the websocket connection and trigger reconnect churn.

Fix:
Introduce a hasLocalSyncTag() helper that determines controller
ownership at the object level.
It returns true only when the object itself carries a tagAnnotation
child with key aci-containers-controller-tag, a value matching the
controller sync tag prefix, and an annotation DN that is local to the
object's own DN.

All delete decision points in apicObjCmp, diffApicState, and
reconcileApicObject now gate deletes on hasLocalSyncTag(). APIC-managed
helper children that appear in the subtree but do not have their own
local annotation fail this check and are skipped. Legitimate
controller-owned objects that were written with their own tagAnnotation
continue to be deleted as expected.

Pull Request Pull Request #1741: fix(apicapi): block helper-MO deletes using tag-based ownership

Coverage Stats

27 of 31 new or added lines in 1 file covered. (87.1%)

4 existing lines in 2 files now uncovered.

13687 of 21382 relevant lines covered (64.01%)

0.73 hits per line