OVS: validate distributed VPC topology updates - #13792
Draft
Dogface2k wants to merge 3 commits into
Draft
Conversation
Codecov Report❌ Patch coverage is
Additional details and impacted files@@ Coverage Diff @@
## main #13792 +/- ##
==========================================
Coverage 19.65% 19.65%
+ Complexity 19792 19766 -26
==========================================
Files 6368 6368
Lines 574881 575296 +415
Branches 70351 70359 +8
==========================================
+ Hits 112970 113099 +129
- Misses 449639 449909 +270
- Partials 12272 12288 +16
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
DaanHoogland
requested review from
weizhouapache
and
a lite review from Copilot
August 5, 2026 09:27
Contributor
|
@blueorangutan package |
|
@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress. |
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Updates OVS distributed-router topology handling to scope updates to OVS-owned distributed VPCs, add validation for malformed topology inputs, and isolate per‑VPC failures so one bad VPC doesn’t abort processing.
Changes:
- Add
isOvsDistributedRouterVpc(...)and use it to limit topology/policy updates to OVS connectivity VPCs. - Wrap per‑VPC topology update work in
try/catchto continue processing other VPCs on failures. - Add validation and actionable exceptions for malformed Vswitch broadcast URI / broadcast key / missing gateway NIC, plus unit tests.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| plugins/network-elements/ovs/src/main/java/com/cloud/network/ovs/OvsTunnelManagerImpl.java | Adds OVS-specific VPC filtering, per‑VPC failure containment, and stricter topology validation. |
| plugins/network-elements/ovs/src/test/java/com/cloud/network/ovs/OvsTunnelManagerImplTest.java | Adds focused unit coverage for OVS ownership checks, topology validation, and continuation behavior. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+778
to
+784
| int greKey; | ||
| try { | ||
| greKey = Integer.parseInt(key.substring(expectedPrefix.length())); | ||
| } catch (NumberFormatException e) { | ||
| throw new CloudRuntimeException(String.format( | ||
| "OVS distributed-router network %s has non-numeric GRE key %s", | ||
| network.getUuid(), key.substring(expectedPrefix.length())), e); |
Comment on lines
+324
to
+329
| @Test | ||
| public void testPrepareVpcTopologyUpdateRejectsGreKeyOutsideIntegerRange() { | ||
| prepareVswitchNetwork("7.2147483648"); | ||
|
|
||
| assertThrows(CloudRuntimeException.class, () -> manager.prepareVpcTopologyUpdate(VPC_ID)); | ||
| } |
Comment on lines
692
to
+699
| for (Long vpcId: vpcIds) { | ||
| VpcVO vpc = _vpcDao.findById(vpcId); | ||
| // nothing to do if the VPC is not setup for distributed routing | ||
| if (vpc == null || !vpc.usesDistributedRouter()) { | ||
| return; | ||
| if (!isOvsDistributedRouterVpc(vpcId)) { | ||
| continue; | ||
| } | ||
|
|
||
| // get the list of hosts on which VPC spans (i.e hosts that need to be aware of VPC topology change update) | ||
| List<Long> vpcSpannedHostIds = _ovsNetworkToplogyGuru.getVpcSpannedHosts(vpcId); | ||
| String bridgeName=generateBridgeNameForVpc(vpcId); | ||
|
|
||
| OvsVpcPhysicalTopologyConfigCommand topologyConfigCommand = prepareVpcTopologyUpdate(vpcId); | ||
| topologyConfigCommand.setSequenceNumber(getNextTopologyUpdateSequenceNumber(vpcId)); | ||
|
|
||
| // send topology change update to VPC spanned hosts | ||
| for (Long id: vpcSpannedHostIds) { | ||
| if (!sendVpcTopologyChangeUpdate(topologyConfigCommand, id, bridgeName)) { | ||
| logger.debug("Failed to send VPC topology change update to host : " + id + ". Moving on " + | ||
| "with rest of the host update."); | ||
| try { | ||
| // get the list of hosts on which VPC spans (i.e hosts that need to be aware of VPC topology change update) | ||
| List<Long> vpcSpannedHostIds = _ovsNetworkToplogyGuru.getVpcSpannedHosts(vpcId); |
Comment on lines
+147
to
+149
| public void testPostStateTransitionEventContinuesAfterNonOvsVpc() { | ||
| VpcVO firstVpc = mock(VpcVO.class); | ||
| VpcVO secondVpc = mock(VpcVO.class); |
|
Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18775 |
Dogface2k
force-pushed
the
agent/ovs-distributed-vpc-topology
branch
from
August 5, 2026 18:49
42863fd to
35f55cc
Compare
Dogface2k
force-pushed
the
agent/ovs-distributed-vpc-topology
branch
from
August 5, 2026 18:51
35f55cc to
42863fd
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Validation
The change is isolated from the NSX, VPN, CKS, and UI feature work. The focused OVS tests are included in this branch and the full 4.23 build has already compiled the corresponding source tree. Draft status is intentional pending the repository CI run / e2e
TODO: do not narrow the GRE key from long to signed int.
Keep greKey as long, parse it with Long.parseLong(), and explicitly validate it as a positive unsigned 32-bit GRE value. Integer.parseInt() rejects values from 2147483648 through 4294967295, even though GRE has a 32-bit key. OvsVpcPhysicalTopologyConfigCommand.Tier already stores greKey as long.
The test that currently expects 2147483648 to be rejected should be changed accordingly.
TODO: move isOvsDistributedRouterVpc(vpcId) inside the per-VPC try/catch.
The provider/VPC lookup currently happens before the catch, so an exception from that lookup can still abort processing of every later VPC, contrary to the failure-isolation goal of this PR.
Add a test where the first VPC's provider lookup throws and a second valid OVS distributed VPC still reaches topology generation or sending. The existing continuation tests only make the second VPC non-OVS and verify that it was inspected.