issue NewValidation: CSCwi17652 check for service-ep flag#328
issue NewValidation: CSCwi17652 check for service-ep flag#328jeestr4d wants to merge 14 commits into
Conversation
* Support multithread execution * fix: switch_ssd_check regex and add pytest * fix: MANUAL instead of ERROR when switch bootflash objects not found * fix: MANUAL instead of ERROR when switch sup objects not found * bump to v3.4.13 * feat: Add fabricNode in common_data * fix: fallback on firmware queries on older ACI version to get current ver * fix: fallback to infraWiNode with pre-4.0 without fabricNode.address * test: fail mock_icurl when test data is not provided * fix: Change error message for API timeout * fix: raise exception with empty imdata with totalCount>1 * fix: pytest error for version display * fix: Abort correctly when user is not authorized to access firmwareCtrlrRunning * fix: Output from a timed out test thread task impacts other tests result * fix: Raise exception with empty imdata with totalCount>0. Handle docker0 check error individually * Bump to v4.0.0
* updated vmm_inventory_partial_sync to align with v3.0 paradigm * Enhanced by looking for changeset partial-inv to avoid flagging on the other reasons. * merge mater + fix pytest --------- Co-authored-by: Gabriel <gmonroy@cisco.com>
…pported to pre-6.2.1 version. (#289) * feat: Add pre-upgrade warning for APIC 6.2.1 that downgrade is not supported to pre-6.2.1 version. --------- Co-authored-by: Saket <saketk@cisco.com> Co-authored-by: tkishida <tkishida@cisco.com>
| vnsLIfCtxs = icurl("class", vnsLIfCtx_api) | ||
|
|
||
| for vnsLIfCtx in vnsLIfCtxs: | ||
| if ("vnsRsLIfCtxToSvcRedirectPol" not in vnsLIfCtx["vnsLIfCtx"]["children"][0]): |
There was a problem hiding this comment.
High — do not depend on APIC child ordering. This only examines children[0], but APIC child ordering is not a contract. A valid vnsRsLIfCtxToSvcRedirectPol later in the list will be missed and produce a false outage warning; an empty list raises IndexError and turns the check into ERROR. Please search all children for a valid redirect relationship and add shuffled-order, empty-child, and malformed-relation tests.
| bd_dn_regex = r"uni/tn-(?P<bd_tn>[^/]+)/BD-(?P<bd>[^/]+)" | ||
|
|
||
| sg_regex = r"uni/tn-(?P<sg_tn>[^/]+)/" | ||
| sg_regex += r"ldevCtx-c-(?P<ldev_ctrc>[^-][^g]+)" |
There was a problem hiding this comment.
High — preserve evidence when DN parsing fails. These character-class expressions reject otherwise valid names containing lowercase g in the contract or lowercase n in the graph. The code later sets FAIL_O even when parsing returns no match, but records neither formatted nor unformatted evidence, yielding a critical result with no affected object. Please use delimiter-aware parsing and append the original vnsLIfCtx DN to unformatted_data whenever formatting fails, without downgrading the outage status. Add lowercase-name and malformed-DN test cases that assert the returned evidence.
| cversion.older_than("5.2(5c)") and tversion.older_than("5.2(5c)") | ||
| ) or ( | ||
| # Current version not affected target version fixed | ||
| cversion.older_than("5.2(5b)") and tversion.newer_than("6.0(8e)") |
There was a problem hiding this comment.
Blocking — use the correct release families and inclusive boundaries. tversion is the target APIC version, but this gate compares it with 6.0(8e), while #294 identifies switch 16.0(8e) / APIC 6.1(1f) as the fixed boundary. This can classify affected upgrade paths incorrectly, and older_than / newer_than exclude the exact boundary releases. Please encode the APIC and switch boundaries separately (using sw_cversion where required), apply inclusive boundary logic, and add tests immediately below, at, and above 5.2(5c), 6.0(1g), 16.0(8e), and 6.1(1f).
| recommended_action = ( | ||
| "\n\tConfirm that within these BDs the PBR configuration is complete." | ||
| "\n\tPlease check the reference document for details." | ||
| ) |
There was a problem hiding this comment.
Medium — direct users to TAC rather than only suggesting a configuration review. The CSCwi17652 defect evidence and #294 indicate remediation requires Cisco TAC and an internal test API. The current action may encourage unsupported configuration changes or proceeding without remediation. Please explicitly instruct users to contact Cisco TAC before upgrading, and assert the complete recommended_action in the tests.
| @@ -0,0 +1,5880 @@ | |||
| # SPDX-License-Identifier: Apache-2.0 | |||
There was a problem hiding this comment.
Medium — remove this accidental repository artifact. This unrelated 5,880-line copy of the older v3.2 script exposes an internal address in its filename and can confuse packaging and maintenance. Please remove it. The branch should also be rebased onto the current v4.2.0-dev; the effective PR currently spans 389 files and GitHub reports it as conflicting.
monrog2
left a comment
monrog2
left a comment
There was a problem hiding this comment.
Requesting changes for the five inline findings:
- Correct APIC/switch release-family gates and inclusive boundaries.
- Make redirect-policy detection independent of child ordering.
- Preserve affected-object evidence when DN parsing fails.
- Direct users to Cisco TAC before upgrade.
- Remove the accidental duplicate script and rebase this conflicting 389-file branch onto current v4.2.0-dev.
Please add the boundary and edge-case tests called out inline.
5 participants
Fixes #294 fixed
Lab output:
[Check 88/88] Service-EP Flag in BD without PBR... FAIL - OUTAGE WARNING!!
Tenant Bridge Domain Service Graph Device Device Node Name
CIB Prod-LB-IN_BD Prod_FTD_LB_Local N2
CIB Prod-LB-Out_BD Prod-FW-LB-SG node2
CIB Prod-LB-Out_BD Prod-FW-LB-SG node2
CIB Prod-LB-Out_BD Prod_FTD_LB_Local N2
CIB Prod-LB-Out_BD Prod_FTD_LB_Local N2
DMZ-TN BD-L3-MPG01-IWF-EGR SG-IWF-MPG01-TEMPLATE IWF-MPG01
DMZ-TN BD-L3-MPG02-IWF-EGR SG-IWF-MPG02-TEMPLATE IWF-MPG02
aperezos PBR_in FTGA-EW N1
Recommended Action:
Confirm that within these BDs the PBR configuration is complete.
Please check the reference document for details.
Reference Document: https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#service-ep-flag-in-bd-without-pbr
jeestrad@JEESTRAD-M-L6VV ACI-Pre-Upgrade-Validation-Script % python3 -m pytest tests/service-ep_flag_bd_check
============================================================================================= test session starts =============================================================================================
platform darwin -- Python 3.9.6, pytest-8.2.0, pluggy-1.5.0
rootdir: /Users/jeestrad/Documents/Python/pre-upgrade/ACI-Pre-Upgrade-Validation-Script
configfile: pytest.ini
plugins: anyio-4.8.0
collected 7 items
tests/service-ep_flag_bd_check/test_service-ep_flag_bd_check.py::test_logic[icurl_outputs0-5.2(8h)-None-MANUAL CHECK REQUIRED]
----------------------------------------------------------------------------------------------- live log setup ------------------------------------------------------------------------------------------------
[15:19:43.876 INFO initialize:5653] Cleaning up previous run files in preupgrade_validator_logs/
[15:19:43.877 INFO initialize:5655] Creating directories preupgrade_validator_logs/ and preupgrade_validator_logs/json_results/
PASSED [ 14%]
tests/service-ep_flag_bd_check/test_service-ep_flag_bd_check.py::test_logic[icurl_outputs1-6.0(8h)-6.1(1g)-N/A] PASSED [ 28%]
tests/service-ep_flag_bd_check/test_service-ep_flag_bd_check.py::test_logic[icurl_outputs2-4.2(7s)-5.2(4c)-N/A] PASSED [ 42%]
tests/service-ep_flag_bd_check/test_service-ep_flag_bd_check.py::test_logic[icurl_outputs3-5.2(8h)-6.0(8e)-FAIL - OUTAGE WARNING!!] PASSED [ 57%]
tests/service-ep_flag_bd_check/test_service-ep_flag_bd_check.py::test_logic[icurl_outputs4-5.2(8h)-6.1(1f)-FAIL - OUTAGE WARNING!!] PASSED [ 71%]
tests/service-ep_flag_bd_check/test_service-ep_flag_bd_check.py::test_logic[icurl_outputs5-5.2(8h)-6.0(8e)-PASS] PASSED [ 85%]
tests/service-ep_flag_bd_check/test_service-ep_flag_bd_check.py::test_logic[icurl_outputs6-5.2(8h)-6.1(1f)-PASS] PASSED [100%]
============================================================================================== 7 passed in 0.03s ==============================================================================================
jeestrad@JEESTRAD-M-L6VV ACI-Pre-Upgrade-Validation-Script %