noironetworks / aci-containers / 11634 / 1
63%
master: 63%

LAST BUILD BRANCH: ocp421-flavor
DEFAULT BRANCH: master
Ran
Files 48
Run time 1s
Badge
Embed ▾
README BADGES
x

If you need to use a raster PNG badge, change the '.svg' to '.png' in the link

Markdown

Textile

RDoc

HTML

Rst
coverage: 62.867% (+0.02%) from 62.843%
DEFAULT_BRANCH=master GOPROXY=https://proxy.golang.org,https://goproxy.io,direct

push

travis-pro

jeffinkottaram 
Prevent deletion of APIC objects not owned by this controller

This commit adds tag-based ownership verification before deleting APIC objects,
preventing accidental deletion of resources managed by other controllers or
created manually.

Changes:

1. Add isOwnedByController() to verify sync tag before deletion
   - Fetches object from APIC with tagAnnotation child
   - Checks if tag matches controller's prefix pattern
   - Returns false if object doesn't exist or lacks controller's tag
   - Protects against race conditions in subscription notification callbacks

2. Introduce pendingChangeSyncDelete for sync-initiated deletions
   - Sync/reconcile operations already verify ownership before queueing deletes
   - Bypass redundant GET request by using pendingChangeSyncDelete kind
   - Subscription-triggered deletes without desired state still check ownership

3. Optimize websocket notification filtering
   - Probe AciNameForKey at initialization to detect prefix embedding behavior
   - Filter notifications under vrfTenant lacking controller's prefix
   - Bypass filter for subscriptions with hooks (e.g., fvSubnet tracking all BDs)
   - Use inline string concatenation instead of pre-computed fields

This fix addresses incorrect deletion of resources in multi-controller and
manually-managed scenarios while maintaining performance through intelligent
filtering and eliminating redundant APIC lookups where ownership is already known.

13495 of 21466 relevant lines covered (62.87%)

0.72 hits per line

Source Files on job 11634.1 (DEFAULT_BRANCH=master GOPROXY=https://proxy.golang.org,https://goproxy.io,direct)