Allow updating of Load Balancer source CIDR list #10968

CodeBleu · 2025-06-05T16:42:14Z

Description

This PR will allow the updating of a loadbalancer rules CIDR list via the API.
* Should fix #9313

Not 100% sure this is the correct place to base and create PR for, but this issue does exist in 4.19, 4.20, and main. I figure I'd start here and see what is needed to get this into the code base so >= 4.19 will have the fixes.

I have tested this code in 4.19, 4.20, and main branches via simulator and all works, just not sure of the process to get this fix into those branches.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

Before, the Source CIDR list was blank (Simulator env)

(localcloud) :penguin: > list loadbalancerrules
{
  "count": 1,
  "loadbalancerrule": [
    {
      "account": "admin",
      "algorithm": "roundrobin",
      "cidrlist": "",
      "domain": "ROOT",
      "domainid": "5b6a2947-416b-11f0-9a39-564a8191c23c",
      "domainpath": "/",
      "fordisplay": true,
      "id": "0d8e3cb9-767b-45f3-834d-3f9ce85df901",
      "name": "newlbtest",
      "networkid": "5bb3ecfb-cde3-4821-8822-0c4c8a8e9559",
      "privateport": "3306",
      "protocol": "tcp",
      "publicip": "192.168.2.10",
      "publicipid": "9b2638d7-7330-49c7-9d6e-5b5777f6ca16",
      "publicport": "3306",
      "state": "Add",
      "tags": [],
      "zoneid": "7cb86a09-676e-4f00-ad39-012f0eb2e69d",
      "zonename": "Sandbox-simulator"
    }
  ]
}
(localcloud) :penguin: > update loadbalancerrule id="0d8e3cb9-767b-45f3-834d-3f9ce85df901" cidrlist="1.2.3.4/32"
{
  "loadbalancer": {
    "account": "admin",
    "algorithm": "roundrobin",
    "cidrlist": "1.2.3.4/32",
    "domain": "ROOT",
    "domainid": "5b6a2947-416b-11f0-9a39-564a8191c23c",
    "domainpath": "/",
    "fordisplay": true,
    "id": "0d8e3cb9-767b-45f3-834d-3f9ce85df901",
    "name": "newlbtest",
    "networkid": "5bb3ecfb-cde3-4821-8822-0c4c8a8e9559",
    "privateport": "3306",
    "protocol": "tcp",
    "publicip": "192.168.2.10",
    "publicipid": "9b2638d7-7330-49c7-9d6e-5b5777f6ca16",
    "publicport": "3306",
    "state": "Add",
    "tags": [],
    "zoneid": "7cb86a09-676e-4f00-ad39-012f0eb2e69d",
    "zonename": "Sandbox-simulator"
  }
}
(localcloud) :penguin: > update loadbalancerrule id="0d8e3cb9-767b-45f3-834d-3f9ce85df901" cidrlist=
{
  "loadbalancer": {
    "account": "admin",
    "algorithm": "roundrobin",
    "cidrlist": "",
    "domain": "ROOT",
    "domainid": "5b6a2947-416b-11f0-9a39-564a8191c23c",
    "domainpath": "/",
    "fordisplay": true,
    "id": "0d8e3cb9-767b-45f3-834d-3f9ce85df901",
    "name": "newlbtest",
    "networkid": "5bb3ecfb-cde3-4821-8822-0c4c8a8e9559",
    "privateport": "3306",
    "protocol": "tcp",
    "publicip": "192.168.2.10",
    "publicipid": "9b2638d7-7330-49c7-9d6e-5b5777f6ca16",
    "publicport": "3306",
    "state": "Add",
    "tags": [],
    "zoneid": "7cb86a09-676e-4f00-ad39-012f0eb2e69d",
    "zonename": "Sandbox-simulator"
  }
}

Tested on actual test environment and below is where you can see when it was restricted it didn't connect to mysql, but when opened up and CIDR set to 0.0.0.0/0 it worked. I tested with specific Public IP in CIDR as well (x.x.0.118/32) and this works and you can see in the virtual router for haproxy it set the ACL.

Restricted with wrong IP in source CIDR of LB

⮡ $ mysql -h x.x.x.110 -u root -p
Enter password:
ERROR 2013 (HY000): Lost connection to MySQL server at 'reading initial communication packet', system error: 104

With correct source CIDR or 0.0.0.0/0

$ mysql -h x.x.x.110 -u root -p
Enter password:
Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 4730216
Server version: 8.0.33 MySQL Community Server - GPL

Copyright (c) 2000, 2024, Oracle and/or its affiliates.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> quit
Bye

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Ran multiple tests with Cloudmonkey against simulator and actual test environment. See above for testing info

* Should fix apache#9313

boring-cyborg · 2025-06-05T16:42:18Z

Congratulations on your first Pull Request and welcome to the Apache CloudStack community! If you have any issues or are unsure about any anything please check our Contribution Guide (https://github.com/apache/cloudstack/blob/main/CONTRIBUTING.md)
Here are some useful points:

In case of a new feature add useful documentation (raise doc PR at https://github.com/apache/cloudstack-documentation)
Be patient and persistent. It might take some time to get a review or get the final approval from the committers.
Pay attention to the quality of your code, ensure tests are passing and your PR doesn't have conflicts.
Please follow ASF Code of Conduct for all communication including (but not limited to) comments on Pull Requests, Issues, Mailing list and Slack.
Be sure to read the CloudStack Coding Conventions.
Apache CloudStack is a community-driven project and together we are making it better 🚀.
In case of doubts contact the developers at:
Mailing List: [email protected] (https://cloudstack.apache.org/mailing-lists.html)
Slack: https://apachecloudstack.slack.com/

codecov · 2025-06-05T16:50:29Z

Codecov Report

Attention: Patch coverage is 25.00000% with 15 lines in your changes missing coverage. Please review.

Project coverage is 15.18%. Comparing base (5be6b79) to head (80c39f1).

Files with missing lines	Patch %	Lines
...loud/network/lb/LoadBalancingRulesManagerImpl.java	7.14%	7 Missing and 6 partials ⚠️
...d/user/loadbalancer/UpdateLoadBalancerRuleCmd.java	33.33%	2 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff            @@
##               4.19   #10968   +/-   ##
=========================================
  Coverage     15.17%   15.18%           
- Complexity    11360    11370   +10     
=========================================
  Files          5416     5416           
  Lines        475890   475909   +19     
  Branches      58093    58101    +8     
=========================================
+ Hits          72230    72270   +40     
+ Misses       395573   395545   -28     
- Partials       8087     8094    +7

Flag	Coverage Δ
uitests	`4.28% <ø> (ø)`
unittests	`15.91% <25.00%> (+<0.01%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

DaanHoogland · 2025-06-09T14:35:49Z

@CodeBleu 4.19 is perfectly alright for this PR.

DaanHoogland

clgtm

CodeBleu · 2025-06-09T18:31:16Z

@CodeBleu 4.19 is perfectly alright for this PR.

@DaanHoogland Great, thanks!
Since I'm new to this process, I had a couple questions.

Do I need another review/approval before I or someone else does the "Squash and merge"?
How and when will this change make it to the next version of 4.19.x, 4.20.x and 4.21.x?

DaanHoogland · 2025-06-09T19:55:07Z

@CodeBleu 4.19 is perfectly alright for this PR.

@DaanHoogland Great, thanks!
Since I'm new to this process, I had a couple questions.

Do I need another review/approval before I or someone else does the "Squash and merge"?

Yes, we should encode this better. We require least two reviews and minimal 1 "external" tester.

How and when will this change make it to the next version of 4.19.x, 4.20.x and 4.21.x?

When merged by a committer, we will merge the target branch forward to all release branches and main.

DaanHoogland · 2025-06-11T17:24:58Z

@blueorangutan package

blueorangutan · 2025-06-11T17:26:04Z

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2025-06-11T18:24:56Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 13717

DaanHoogland · 2025-06-12T06:57:52Z

@blueorangutan test

blueorangutan · 2025-06-12T07:00:05Z

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2025-06-12T07:50:31Z

[SF] Trillian Build Failed (tid-13506)

blueorangutan · 2025-06-12T22:25:23Z

[SF] Trillian test result (tid-13507)
Environment: kvm-ol8 (x2), Advanced Networking with Mgmt server ol8
Total time taken: 47902 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr10968-t13507-kvm-ol8.zip
Smoke tests completed. 133 look OK, 0 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File

Allow updating of Load Balancer source CIDR list

b2175d2

* Should fix apache#9313

CodeBleu requested a review from DaanHoogland June 5, 2025 16:42

boring-cyborg bot added component:api component:networking labels Jun 5, 2025

CodeBleu requested a review from weizhouapache June 5, 2025 16:56

CodeBleu added 2 commits June 5, 2025 15:01

Added test coverage for LoadBalancerVO

2590c69

Add License text to LoadBalancerVOTest.java file

80c39f1

CodeBleu mentioned this pull request Jun 6, 2025

Support firewall rules on Public IP in VPC #8863

Open

DaanHoogland approved these changes Jun 9, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Allow updating of Load Balancer source CIDR list #10968

Allow updating of Load Balancer source CIDR list #10968

Uh oh!

CodeBleu commented Jun 5, 2025

Uh oh!

boring-cyborg bot commented Jun 5, 2025

Uh oh!

codecov bot commented Jun 5, 2025 •

edited

Loading

Uh oh!

DaanHoogland commented Jun 9, 2025

Uh oh!

DaanHoogland left a comment

Uh oh!

CodeBleu commented Jun 9, 2025

Uh oh!

DaanHoogland commented Jun 9, 2025

Uh oh!

DaanHoogland commented Jun 11, 2025

Uh oh!

blueorangutan commented Jun 11, 2025

Uh oh!

blueorangutan commented Jun 11, 2025

Uh oh!

DaanHoogland commented Jun 12, 2025

Uh oh!

blueorangutan commented Jun 12, 2025

Uh oh!

blueorangutan commented Jun 12, 2025

Uh oh!

blueorangutan commented Jun 12, 2025

Uh oh!

Uh oh!

Allow updating of Load Balancer source CIDR list #10968

Are you sure you want to change the base?

Allow updating of Load Balancer source CIDR list #10968

Uh oh!

Conversation

CodeBleu commented Jun 5, 2025

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

boring-cyborg bot commented Jun 5, 2025

Uh oh!

codecov bot commented Jun 5, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

DaanHoogland commented Jun 9, 2025

Uh oh!

DaanHoogland left a comment

Choose a reason for hiding this comment

Uh oh!

CodeBleu commented Jun 9, 2025

Uh oh!

DaanHoogland commented Jun 9, 2025

Uh oh!

DaanHoogland commented Jun 11, 2025

Uh oh!

blueorangutan commented Jun 11, 2025

Uh oh!

blueorangutan commented Jun 11, 2025

Uh oh!

DaanHoogland commented Jun 12, 2025

Uh oh!

blueorangutan commented Jun 12, 2025

Uh oh!

blueorangutan commented Jun 12, 2025

Uh oh!

blueorangutan commented Jun 12, 2025

Uh oh!

Uh oh!

codecov bot commented Jun 5, 2025 •

edited

Loading