VPC VR: fix ACL between tier and private gateway by weizhouapache · Pull Request #10268 · apache/cloudstack

weizhouapache · 2025-01-24T12:53:46Z

Description

This PR fixes #9838

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

weizhouapache · 2025-01-24T12:53:56Z

@blueorangutan package

blueorangutan · 2025-01-24T12:56:03Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

codecov · 2025-01-24T13:01:41Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 15.16%. Comparing base (2aa2e92) to head (8d3468e).
Report is 29 commits behind head on 4.19.

Additional details and impacted files

@@             Coverage Diff              @@
##               4.19   #10268      +/-   ##
============================================
+ Coverage     15.14%   15.16%   +0.01%     
- Complexity    11283    11299      +16     
============================================
  Files          5408     5408              
  Lines        473822   473891      +69     
  Branches      57825    57838      +13     
============================================
+ Hits          71762    71860      +98     
+ Misses       394037   393998      -39     
- Partials       8023     8033      +10

Flag	Coverage Δ
uitests	`4.29% <ø> (-0.01%)`	⬇️
unittests	`15.88% <ø> (+0.02%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

blueorangutan · 2025-01-24T14:03:32Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 12203

weizhouapache · 2025-01-24T15:49:04Z

@blueorangutan test

blueorangutan · 2025-01-24T15:50:03Z

@weizhouapache a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-01-25T05:11:34Z

[SF] Trillian test result (tid-12186)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 45813 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10268-t12186-kvm-ol8.zip
Smoke tests completed. 133 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

DaanHoogland

clgtm

This fixes the issue that SSH/ping does not work from vm in private network to vm in vpc, if - VPC tier uses ACL default_allow - private gateway uses ACL "allow egress but deny ingress"

weizhouapache · 2025-01-30T16:22:42Z

@blueorangutan package

blueorangutan · 2025-01-30T16:24:05Z

@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-01-30T17:24:00Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 12276

weizhouapache · 2025-01-30T19:24:57Z

@blueorangutan test

blueorangutan · 2025-01-30T19:26:04Z

@weizhouapache a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-01-31T09:59:35Z

[SF] Trillian test result (tid-12248)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 49774 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10268-t12248-kvm-ol8.zip
Smoke tests completed. 131 look OK, 2 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_create_pvlan_network	`Error`	0.12	test_pvlan.py
test_12_start_vm_multiple_volumes_allocated	`Error`	18.35	test_vm_life_cycle.py

weizhouapache · 2025-01-31T10:31:47Z

@blueorangutan test

blueorangutan · 2025-01-31T10:34:03Z

@weizhouapache a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-01-31T23:53:58Z

[SF] Trillian test result (tid-12251)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 45537 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10268-t12251-kvm-ol8.zip
Smoke tests completed. 132 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_12_start_vm_multiple_volumes_allocated	`Error`	13.21	test_vm_life_cycle.py

Pearl1594

code LGTM

DaanHoogland · 2025-02-03T15:10:05Z

@weizhouapache can you look at that remaining error?

[SF] Trillian test result (tid-12251) Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8 Total time taken: 45537 seconds Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10268-t12251-kvm-ol8.zip Smoke tests completed. 132 look OK, 1 have errors, 0 did not run Only failed and skipped tests results shown below:
Test Result Time (s) Test File
test_12_start_vm_multiple_volumes_allocated Error 13.21 test_vm_life_cycle.py

weizhouapache · 2025-02-03T16:57:10Z

@blueorangutan test

blueorangutan · 2025-02-03T16:58:03Z

@weizhouapache a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-02-04T07:38:07Z

[SF] Trillian test result (tid-12289)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 50347 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10268-t12289-kvm-ol8.zip
Smoke tests completed. 131 look OK, 2 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_01_secure_vm_migration	`Error`	396.01	test_vm_life_cycle.py
test_12_start_vm_multiple_volumes_allocated	`Error`	13.01	test_vm_life_cycle.py
test_01_create_redundant_VPC_2tiers_4VMs_4IPs_4PF_ACL	`Failure`	388.26	test_vpc_redundant.py
test_02_redundant_VPC_default_routes	`Failure`	391.31	test_vpc_redundant.py
test_04_rvpc_network_garbage_collector_nics	`Failure`	390.38	test_vpc_redundant.py

VPC VR: fix ACL between tier and private gateway

84c2a8a

boring-cyborg bot added component:networking component:virtual-router Python Warning... Python code Ahead! labels Jan 24, 2025

weizhouapache linked an issue Jan 24, 2025 that may be closed by this pull request

private gateway ACLs are not applied correctly #9838

Closed

DaanHoogland added this to the 4.19.2 milestone Jan 24, 2025

DaanHoogland approved these changes Jan 27, 2025

View reviewed changes

VPC VR: update iptables rule

8d3468e

This fixes the issue that SSH/ping does not work from vm in private network to vm in vpc, if - VPC tier uses ACL default_allow - private gateway uses ACL "allow egress but deny ingress"

weizhouapache mentioned this pull request Jan 30, 2025

Fix private gateway acl on static routes #10262

Merged

14 tasks

weizhouapache marked this pull request as ready for review January 30, 2025 19:25

DaanHoogland assigned Pearl1594 Feb 1, 2025

Pearl1594 approved these changes Feb 3, 2025

View reviewed changes

DaanHoogland merged commit 90c960e into apache:4.19 Feb 4, 2025

DaanHoogland deleted the 4.19-fix-private-gw-acl branch February 4, 2025 15:15

DaanHoogland mentioned this pull request Feb 13, 2025

private gateway ACLs are not applied correctly #9838

Closed

dhslove pushed a commit to ablecloud-team/ablestack-cloud that referenced this pull request Jun 19, 2025

VPC VR: fix ACL between tier and private gateway (apache#10268)

7e93363

Conversation

weizhouapache commented Jan 24, 2025

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

weizhouapache commented Jan 24, 2025

Uh oh!

blueorangutan commented Jan 24, 2025

Uh oh!

codecov bot commented Jan 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented Jan 24, 2025

Uh oh!

weizhouapache commented Jan 24, 2025

Uh oh!

blueorangutan commented Jan 24, 2025

Uh oh!

blueorangutan commented Jan 25, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

weizhouapache commented Jan 30, 2025

Uh oh!

blueorangutan commented Jan 30, 2025

Uh oh!

blueorangutan commented Jan 30, 2025

Uh oh!

weizhouapache commented Jan 30, 2025

Uh oh!

blueorangutan commented Jan 30, 2025

Uh oh!

blueorangutan commented Jan 31, 2025

Uh oh!

weizhouapache commented Jan 31, 2025

Uh oh!

blueorangutan commented Jan 31, 2025

Uh oh!

blueorangutan commented Jan 31, 2025

Uh oh!

Pearl1594 left a comment

Choose a reason for hiding this comment

Uh oh!

DaanHoogland commented Feb 3, 2025

Uh oh!

weizhouapache commented Feb 3, 2025

Uh oh!

blueorangutan commented Feb 3, 2025

Uh oh!

blueorangutan commented Feb 4, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

codecov bot commented Jan 24, 2025 •

edited

Loading