noironetworks / aci-containers
64%
master: 64%

LAST BUILD BRANCH: apic-non-deletable-objects
DEFAULT BRANCH: master
Repo Added
Files 48
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst

LAST BUILD ON BRANCH apic-non-deletable-objects
branch: SELECT
CHANGE BRANCH
x

coverage: 64.01% (+0.04%) from 63.969%
12033

Pull #1741

travis-pro

Santosh-oc 
Fix(apicapi): prevent invalid delete of APIC owned helper MOs

Reproduction:
During SNAT policy churn, the controller repeatedly attempts to DELETE
APIC-managed child relation MOs owned by APIC. APIC rejects these
with HTTP 400 "Invalid access", causing the websocket connection to
close and the controller to enter a reconnect loop.

Root cause:
When an SNAT policy is deleted and immediately recreated, APIC
helper reverse-relation children can appear under service graph
objects during reconcile. In the reconcile path, existing APIC objects
are compared against desired state, and extra current children are
added to delete candidates.

For helper relation classes that are not present in metadata,
checkNonDeletable() defaults to deletable=true. Those relation MOs are then
added to the delete list and queued to APIC. APIC rejects direct
deletion of these reverse-relation MOs with HTTP 400 "Invalid access",
which can close the websocket connection and trigger reconnect churn.

Fix:
Introduce a hasLocalSyncTag() helper that determines controller
ownership at the object level.
It returns true only when the object itself carries a tagAnnotation
child with key aci-containers-controller-tag, a value matching the
controller sync tag prefix, and an annotation DN that is local to the
object's own DN.

All delete decision points in apicObjCmp, diffApicState, and
reconcileApicObject now gate deletes on hasLocalSyncTag(). APIC-managed
helper children that appear in the subtree but do not have their own
local annotation fail this check and are skipped. Legitimate
controller-owned objects that were written with their own tagAnnotation
continue to be deleted as expected.
Pull Request #1741: fix(apicapi): block helper-MO deletes using tag-based ownership

32 of 38 new or added lines in 1 file covered. (84.21%)

6 existing lines in 2 files now uncovered.

13691 of 21389 relevant lines covered (64.01%)

0.73 hits per line

Relevant lines Covered
21389 RELEVANT LINES 13691 COVERED LINES
0.73 HITS PER LINE
Source Files on master

Recent builds

Builds Branch Commit Type Ran Committer Via Coverage
12033 apic-non-deletable-objects Fix(apicapi): prevent invalid delete of APIC owned helper MOs Reproduction: During SNAT policy churn, the controller repeatedly attempts to DELETE APIC-managed child relation MOs owned by APIC. APIC rejects these with HTTP 400 "Invalid access", c... Pull #1741 Santosh-oc travis-pro
64.01
12034 apic-non-deletable-objects Merge a42257aef into dfe9d19d6 Pull #1741 web-flow travis-pro
64.02
12032 apic-non-deletable-objects Merge 6adee2c91 into dfe9d19d6 Pull #1741 web-flow travis-pro
64.01
12031 apic-non-deletable-objects fix(apicapi): block helper-MO deletes using tag-based ownership Reproduction: During SNAT policy churn, the controller repeatedly attempts to DELETE APIC-managed child relation MOs owned by APIC. APIC rejects these with HTTP 400 "Invalid access",... Pull #1741 Santosh-oc travis-pro
64.0
12030 apic-non-deletable-objects Merge 6d1ba88e3 into dfe9d19d6 Pull #1741 web-flow travis-pro
64.02
12029 apic-non-deletable-objects fix(apicapi): block helper-MO deletes using tag-based ownership Reproduction: During SNAT policy churn, the controller repeatedly attempts to DELETE APIC-managed child relation MOs owned by APIC. APIC rejects these with HTTP 400 "Invalid access",... push Santosh-oc travis-pro
64.03
12027 apic-non-deletable-objects Merge e84c9aeee into dfe9d19d6 Pull #1741 web-flow travis-pro
64.05
12026 apic-non-deletable-objects fix(apicapi): block helper-MO deletes using tag-based ownership Reproduction: During SNAT policy churn, the controller repeatedly attempts to DELETE APIC-managed child relation MOs owned by APIC. APIC rejects these with HTTP 400 "Invalid access",... Pull #1741 burhan20 travis-pro
64.01
12024 apic-non-deletable-objects removed logs Pull #1741 Santosh-oc travis-pro
64.04
12025 apic-non-deletable-objects Merge b493d7aac into dfe9d19d6 Pull #1741 web-flow travis-pro
64.02
See All Builds (5140)