NSX: configure segment discovery and security profiles

[Dogface2k]

Summary

This PR adds optional VMware NSX IP Discovery, MAC Discovery, and Segment Security profile bindings to CloudStack network offerings.

The selected profile IDs are stored as network-offering details, exposed through the Add and Clone Network Offering interfaces, propagated through the NSX segment creation command path, and applied when CloudStack creates the corresponding NSX segment.

Behaviour

• adds NsxIpDiscoveryProfileId, NsxMacDiscoveryProfileId, and NsxSegmentSecurityProfileId network-offering details;
• exposes the three optional profile IDs in the Add and Clone Network Offering forms;
• restricts the profile details to NSX-backed network offerings;
• rejects blank profile IDs, surrounding whitespace, and values longer than 255 characters;
• resolves every requested profile from NSX before creating the segment;
• verifies that NSX returned the requested profile ID and the canonical resource path for the expected profile type;
• rejects profiles that NSX reports as marked for deletion;
• preserves the existing direct Segments.patch(...) behaviour when no profiles are configured;
• creates the segment and its requested profile binding maps in one hierarchical Infra.patch(...) request when profiles are configured;
• uses deterministic CloudStack-owned IDs for the discovery and security binding maps;
• prevents an existing network from being upgraded to an offering with different NSX segment profile bindings.

Compatibility and scope

• no database schema migration is required;
• existing NSX network offerings without profile details retain the previous segment creation path;
• non-NSX network offerings are unaffected unless an invalid NSX-only detail is supplied;
• this PR does not change NSX DHCP/IPAM behaviour;
• this PR does not change CloudStack Kubernetes Service load-balancer rule regeneration;
• this PR does not change native NSX Site-to-Site VPN behaviour.

Validation

The branch includes focused unit coverage for:

• segment creation with all three profile bindings;
• IP Discovery-only, MAC Discovery-only, and Segment Security-only bindings;
• preservation of the existing segment PATCH path when no profiles are configured;
• rejection of profiles with a non-canonical path;
• rejection of profiles returned with a different ID;
• rejection of profiles marked for deletion;
• the VMware vAPI NotFound path for a missing profile;
• verification that neither Segments.patch(...) nor Infra.patch(...) is called after profile resolution fails;
• propagation of profile IDs through NsxGuestNetworkGuru, CreateNsxSegmentCommand, NsxResource, and NsxApiClient;
• network-offering detail validation for NSX and non-NSX offerings;
• prevention of network-offering upgrades when profile bindings differ;
• compatibility when both offerings have matching or absent profile bindings.

The current Apache GitHub Actions runs for the fork head are awaiting maintainer approval. No current-head CI pass is claimed until those workflows execute.

Types of changes

• Breaking change
• New feature
• Bug fix
• Enhancement
• Cleanup
• Build/CI
• Test

How did you try to break this feature?

The negative coverage verifies that CloudStack fails before any NSX segment mutation when:

• profile details are supplied for a non-NSX offering;
• a profile ID is blank;
• a profile ID contains surrounding whitespace;
• a profile ID exceeds the accepted length;
• NSX cannot find the requested profile;
• NSX returns a different profile ID;
• NSX returns a path for the wrong profile resource;
• NSX reports the profile as marked for deletion.

The compatibility coverage also verifies that omitting every profile preserves the existing segment creation request and that an active network cannot be silently moved to different profile bindings through a network-offering upgrade.

[codecov]

Codecov Report

❌ Patch coverage is 94.03974% with 9 lines in your changes missing coverage. Please review.
✅ Project coverage is 19.67%. Comparing base (4f11707) to head (f3456b9).

Files with missing lines	Patch %	Lines
...ain/java/com/cloud/network/NetworkServiceImpl.java	71.42%	3 Missing and 1 partial ⚠️
...in/java/org/apache/cloudstack/utils/NsxHelper.java	50.00%	2 Missing ⚠️
.../cloud/configuration/ConfigurationManagerImpl.java	86.66%	0 Missing and 2 partials ⚠️
...apache/cloudstack/service/NsxGuestNetworkGuru.java	87.50%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #13791      +/-   ##
============================================
+ Coverage     19.65%   19.67%   +0.02%     
- Complexity    19792    19820      +28     
============================================
  Files          6368     6368              
  Lines        574881   575041     +160     
  Branches      70351    70373      +22     
============================================
+ Hits         112970   113124     +154     
- Misses       449639   449642       +3     
- Partials      12272    12275       +3     

Flag	Coverage Δ
uitests	3.41% <ø> (-0.01%)	⬇️
unittests	20.94% <94.03%> (+0.02%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

This PR adds support for configuring NSX segment discovery/security profiles via network offering details, validates these settings server-side, passes the selected profile IDs through the agent command path, and updates UI/i18n and unit tests accordingly.

Changes:

• Expose NSX profile ID fields (IP discovery, MAC discovery, segment security) in Add/Clone Network Offering UI and persist them via offering details.
• Validate NSX profile detail constraints (NSX-only, non-blank, no surrounding whitespace, max length) and prevent offering upgrades when profile bindings differ.
• Extend NSX segment creation to resolve/validate profile paths and bind profiles in the same hierarchical Infra request; add targeted unit tests.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
ui/src/views/offering/CloneNetworkOffering.vue	Adds NSX profile input fields and submits them as offering details during clone.
ui/src/views/offering/AddNetworkOffering.vue	Adds NSX profile input fields and includes them in the details key set for submission.
ui/public/locales/en.json	Adds labels/tooltips for the new NSX profile fields.
server/src/test/java/com/cloud/network/NetworkServiceImplTest.java	Adds tests for offering-upgrade behavior based on NSX profile bindings.
server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java	Adds tests for NSX profile detail validation rules.
server/src/main/java/com/cloud/network/NetworkServiceImpl.java	Rejects offering upgrades when NSX segment profile bindings differ.
server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java	Validates NSX segment profile details (NSX-only + formatting/length rules).
plugins/network-elements/nsx/src/test/java/org/apache/cloudstack/service/NsxGuestNetworkGuruTest.java	Verifies profile IDs from offering details are passed into CreateNsxSegmentCommand.
plugins/network-elements/nsx/src/test/java/org/apache/cloudstack/service/NsxApiClientTest.java	Adds tests for binding behavior, validation failures, and “no profiles” behavior.
plugins/network-elements/nsx/src/test/java/org/apache/cloudstack/resource/NsxResourceTest.java	Verifies CreateNsxSegmentCommand profile IDs are forwarded to NsxApiClient.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/utils/NsxHelper.java	Adds overload to build CreateNsxSegmentCommand with optional profile IDs.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/service/NsxGuestNetworkGuru.java	Reads offering details and passes profile IDs into segment creation command.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/service/NsxApiClient.java	Resolves/validates profile paths and issues Infra.patch to create segment + bindings atomically.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/resource/NsxResource.java	Calls NsxApiClient.createSegment with the profile ID arguments.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/agent/api/CreateNsxSegmentCommand.java	Adds profile ID fields and constructor overload for segment creation.
api/src/main/java/org/apache/cloudstack/api/command/admin/network/NetworkOfferingBaseCmd.java	Documents the new NSX offering detail keys in the API parameter description.
api/src/main/java/com/cloud/offering/NetworkOffering.java	Adds new Detail enum values for the NSX profile ID keys.
PendingReleaseNotes	Adds release note entry describing NSX offering profile binding behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.