Added validation check for CSCwt58626#405
Conversation
lovkeshsharma702
left a comment
lovkeshsharma702
left a comment
There was a problem hiding this comment.
all intigrated test passed.
|
|
||
| Due to [CSCwt58626][77], when targeting APIC version 6.1(3f) to 6.1(5e) or 6.2(1g) , if the InfraVLAN overlaps with any user-configured VLAN pool range in Access Policies, fault `F4701` is raised for VLAN pools that include the InfraVLAN. After the upgrade, domains linked to those VLAN pools cannot be associated with new EPGs, although existing EPGs continue to function. | ||
|
|
||
| To avoid this issue, modify user VLAN pool ranges so that the InfraVLAN does not overlap with any configured block or select target version with fix. |
There was a problem hiding this comment.
@lovkeshsharma702 include some detail about the planned fix, otherwise this checks details will have to be updated again after release.
There was a problem hiding this comment.
@lovkeshsharma702 include some detail about the planned fix, otherwise this checks details will have to be updated again after release.
@monrog2 this was a regression in 6.1(3f) to 6.1(5e) or 6.2(1g). fixed above 615 and 6.2.x. only 6.2.2eis release so far, hence fix version for 615 not mentioned in the bug. @muthu-ku please add 6.2.2e as fixed version in bug.
There was a problem hiding this comment.
Main point of this one is to call out the behavior change implemented in the fixed versions.
my understanding is:
PD will block path binding on user tenant if the binding it pushing the infra VLAN.
HOWEVER, Infra tenant can do this without issue.
affected version behavior relies solely on access policy lookup, which means whether infra or user tenant, any extension of infra VLAN causes the fault + blocking condition seen today.
point for clarification is how this would affected vmm bindings for infra vlan within user tenant, such as k8 integration
There was a problem hiding this comment.
@monrog2 check with Dev, they confirm fault raised if infra vlan found in any vlanpool in any tenant. we suggest cu not to use infra vlan in any of vlan pool, or move to fix version, where no fault is being raised.
@muthu-ku please update the "Due to [CSCwt58626][77], when targeting APIC version 6.1(3f) to 6.1(5e) or 6.2(1g) , if the InfraVLAN overlaps with any VLAN pool range in Access Policies, fault F4701 is raised for VLAN pools that include the InfraVLAN. After the upgrade, domains linked to those VLAN pools cannot be associated with new EPGs, although existing EPGs continue to function.
To avoid this issue, modify user VLAN pool ranges so that the InfraVLAN does not overlap with any configured vlan block or select target version with fix."
| try: | ||
| from datetime import timezone | ||
| threshold = datetime.now(timezone.utc).replace(tzinfo=None) - timedelta(hours=24) | ||
| except ImportError: | ||
| threshold = datetime.utcnow() - timedelta(hours=24) |
There was a problem hiding this comment.
this potion is needed to cover
/data/techsupport/muthu/aci-preupgrade-validation-script.py:6688: DeprecationWarning: datetime.datetime.utcnow() is deprecated and scheduled for removal in a future version. Use timezone-aware objects to represent datetimes in UTC: datetime.datetime.now(datetime.UTC).
threshold = datetime.utcnow() - timedelta(hours=24)
Python version Path taken Result
Python 2.x ImportError caught → datetime.utcnow() ✅ Works
Python 3.0–3.11. timezone import succeeds → datetime.now(timezone.utc) ✅ Works, no warning
Python 3.12+ timezone import succeeds → datetime.now(timezone.utc) ✅ Works, no deprecation warning
monrog2
left a comment
monrog2
left a comment
There was a problem hiding this comment.
Requesting changes for correctness against the current CSCwt58626 CDETS data and for fail-safe handling of APIC responses. Each concern is attached inline.
| encap_blocks = icurl('class', 'fvnsEncapBlk.json') | ||
| dn_pool_re = re.compile(r'vlanns-\[(?P<vlan_pool>[^\]]+)\]') | ||
| for obj in encap_blocks: | ||
| blk_attr = obj.get('fvnsEncapBlk', {}).get('attributes', {}) |
There was a problem hiding this comment.
[P1] Filter out non-affected internal blocks. The unfiltered fvnsEncapBlk class response also contains blocks with role: internal, but this loop treats every block as a user VLAN-pool block. A valid internal block containing the InfraVLAN therefore produces FAIL_UF; I reproduced that behavior with an existing internal-role fixture shape. The CDETS example is role: external. Please restrict evaluation to the affected role/object types, and add an internal-role regression case.
| if not dn or not from_encap or not to_encap: | ||
| continue | ||
|
|
||
| pool_match = dn_pool_re.search(dn) | ||
| pool_name = pool_match.group('vlan_pool') if pool_match else '-' | ||
|
|
||
| try: | ||
| from_vlan = int(str(from_encap).split('-')[-1]) | ||
| to_vlan = int(str(to_encap).split('-')[-1]) | ||
| except (ValueError, TypeError): | ||
| continue |
There was a problem hiding this comment.
[P1] Do not turn unparseable APIC data into a PASS. Missing dn/from/to values and malformed VLAN values are silently skipped. If every returned block is malformed, data remains empty and the check reports PASS without establishing that no overlap exists; this is reproducible with a malformed-only response. Track these objects via unformatted_data and return ERROR (or the repository's equivalent incomplete-data result), with malformed-only and mixed valid/malformed tests.
There was a problem hiding this comment.
@muthu-ku please work on the suggestions.
There was a problem hiding this comment.
when you find unformatted Dn, exit loop and print error.
| continue | ||
|
|
||
| pool_match = dn_pool_re.search(dn) | ||
| pool_name = pool_match.group('vlan_pool') if pool_match else '-' |
There was a problem hiding this comment.
[P2] Preserve an actionable identifier for VMM objects. The canonical CDETS object DN is uni/vmmp-VMware/dom-.../usrcustomaggr-.../from-[vlan-...]-to-[vlan-...], which has no vlanns-[...] component. This code detects the overlap but renders the pool as -, so the operator cannot locate the object named by the recommended action. Use the full DN (or a parsed VMM domain/custom aggregate identifier) as the fallback instead of -.
There was a problem hiding this comment.
@monrog2 do you have a vmm setup where i can check. i think when i checked in QA< i found a corresponding vlan pool created with "vlanns-" in db, hence suggested to ignore. but let me double check on this.
|
|
||
| ### Infravlan Overlap Access Policy Check | ||
|
|
||
| Due to [CSCwt58626][77], when targeting APIC version 6.1(3f) to 6.1(5e) or 6.2(1g) , if the InfraVLAN overlaps with any user-configured VLAN pool range in Access Policies, fault `F4701` is raised for VLAN pools that include the InfraVLAN. After the upgrade, domains linked to those VLAN pools cannot be associated with new EPGs, although existing EPGs continue to function. |
There was a problem hiding this comment.
[P2] Document the primary CDETS configuration, not only Access Policy pools. CSCwt58626 specifically reports Kubernetes and VMware VMM custom port groups generated by acc-provision, including usrcustomaggr objects annotated orchestrator:aci-containers-controller with containsInfraVlan: yes. Describing the scope only as user-configured VLAN pool ranges in Access Policies can lead affected VMM/Kubernetes users to dismiss the warning. Please include these orchestrator-created objects and their post-upgrade impact.
There was a problem hiding this comment.
copy that. @muthu-ku please update the bug and script document as well.
| ( | ||
| { | ||
| lldpInst_api: read_data(dir, "lldpInst_infra_vlan_multiple_entry.json"), | ||
| fvnsEncapBlk_api: read_data(dir, "fvnsEncapBlk_overlap_single_vlan_pool.json"), |
There was a problem hiding this comment.
[P2] Add coverage using the actual CDETS object shape. The overlap fixtures only use synthetic vlanns-[pool] DNs and omit role, containsInfraVlan, and annotation, so they cannot catch the internal-role false positive or the unusable - identifier for VMM usrcustomaggr objects. Add a fixture based on the CDETS example, plus internal-role and malformed-object cases, and assert the displayed identifier as well as the result.
There was a problem hiding this comment.
@muthu-ku lets see if can get the rn and role from the moquery to compare and whereever you find the conflicing Mo, report that whole DN .
| if not dn or not from_encap or not to_encap: | ||
| continue | ||
|
|
||
| pool_match = dn_pool_re.search(dn) | ||
| pool_name = pool_match.group('vlan_pool') if pool_match else '-' | ||
|
|
||
| try: | ||
| from_vlan = int(str(from_encap).split('-')[-1]) | ||
| to_vlan = int(str(to_encap).split('-')[-1]) | ||
| except (ValueError, TypeError): | ||
| continue |
There was a problem hiding this comment.
when you find unformatted Dn, exit loop and print error.
3 participants
Added new validation for the defect CSCwt58626.
This check will check if the InfraVLAN overlaps with any user-configured VLAN pool range in Access Policies.
Apic failure logs:
apic_failure_log.txt
apic_full_run_log.txt
pytest_full_run_log.txt