OVS: validate distributed VPC topology updates

[Dogface2k]

Summary

• scope OVS distributed-router topology and ACL updates to VPCs whose Connectivity provider is OVS;
• isolate each VPC's provider lookup and topology update so one unavailable or malformed VPC does not stop processing of later VPCs;
• validate active OVS topology inputs with actionable errors for invalid Vswitch broadcast keys and missing gateway NICs;
• preserve topology GRE keys as long values and validate the network GRE range declared by CloudStack, 0..4294967295;
• include only tiers in Setup, Implementing, or Implemented state in active topology generation, so allocated or teardown-state tiers are not treated as malformed;
• add focused unit coverage for provider ownership, per-VPC failure isolation, tier lifecycle filtering, GRE boundaries, malformed keys, and missing gateway NICs.

Behaviour and compatibility

The VM state listener can observe VPCs whose distributed routing is owned by another network provider. Those VPCs are now ignored by the OVS callback rather than receiving OVS topology updates. The ACL replacement subscriber applies the same provider ownership check.

Provider/VPC eligibility lookup is inside the per-VPC failure boundary. An exception while resolving or generating one VPC's topology is logged for that VPC, and subsequent VPCs continue to be processed.

The active-tier state filter matches the existing OVS VPC tunnel-creation lifecycle. Active tiers still require a Vswitch broadcast URI in the exact vpcId.greKey form and a gateway NIC.

Topology GRE keys are carried by the existing long field in OvsVpcPhysicalTopologyConfigCommand.Tier. Values above the signed integer range remain valid up to 4294967295, while negative, non-numeric, malformed, wrong-VPC, and above-range values fail before a topology command is produced.

No database schema, API contract, or non-OVS network implementation is changed.

Validation

OvsTunnelManagerImplTest covers:

• missing, non-distributed, non-OVS, and valid OVS VPC ownership;
• continuation to a valid OVS VPC after a non-OVS VPC, malformed topology, or provider lookup exception;
• allocated-tier exclusion and active-tier validation;
• accepted GRE keys 0, 2147483648, and 4294967295;
• rejection of negative, non-numeric, malformed, wrong-VPC, and above-range GRE keys;
• rejection of an active tier with no gateway NIC;
• valid topology and ACL-routing-policy generation paths.

[DaanHoogland]

clgtm

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 3.41%. Comparing base (4f11707) to head (cfb09ca).
⚠️ Report is 3 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (4f11707) and HEAD (cfb09ca). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (4f11707)	HEAD (cfb09ca)
unittests	1	0

Additional details and impacted files

@@              Coverage Diff              @@
##               main   #13792       +/-   ##
=============================================
- Coverage     19.65%    3.41%   -16.24%     
=============================================
  Files          6368      487     -5881     
  Lines        574881    41867   -533014     
  Branches      70351     7912    -62439     
=============================================
- Hits         112970     1429   -111541     
+ Misses       449639    40238   -409401     
+ Partials      12272      200    -12072     

Flag	Coverage Δ
uitests	3.41% <ø> (ø)
unittests	?

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Updates OVS distributed-router topology handling to scope updates to OVS-owned distributed VPCs, add validation for malformed topology inputs, and isolate per‑VPC failures so one bad VPC doesn’t abort processing.

Changes:

• Add isOvsDistributedRouterVpc(...) and use it to limit topology/policy updates to OVS connectivity VPCs.
• Wrap per‑VPC topology update work in try/catch to continue processing other VPCs on failures.
• Add validation and actionable exceptions for malformed Vswitch broadcast URI / broadcast key / missing gateway NIC, plus unit tests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
plugins/network-elements/ovs/src/main/java/com/cloud/network/ovs/OvsTunnelManagerImpl.java	Adds OVS-specific VPC filtering, per‑VPC failure containment, and stricter topology validation.
plugins/network-elements/ovs/src/test/java/com/cloud/network/ovs/OvsTunnelManagerImplTest.java	Adds focused unit coverage for OVS ownership checks, topology validation, and continuation behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18783

[DaanHoogland]

@blueorangutan test

[blueorangutan]

@DaanHoogland a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

[Dogface2k]

Last changes being reviewed.

[blueorangutan]

[SF] Trillian test result (tid-16723)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 73869 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13792-t16723-kvm-ol8.zip
Smoke tests completed. 148 look OK, 8 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_01_ssl_offloading_isolated_network	Failure	716.67	test_ssl_offloading.py
test_02_ssl_offloading_project_vpc	Failure	690.26	test_ssl_offloading.py
test_06_download_detached_volume	Error	304.31	test_volumes.py
ContextSuite context=TestVolumes>:teardown	Error	125.32	test_volumes.py
ContextSuite context=TestVPCConserveModeRules>:setup	Error	0.00	test_vpc_conserve_mode.py
ContextSuite context=TestIpv6Vpc>:setup	Error	0.00	test_vpc_ipv6.py
ContextSuite context=TestVPCRedundancy>:setup	Error	0.00	test_vpc_redundant.py
ContextSuite context=TestVPCNics>:setup	Error	0.00	test_vpc_router_nics.py
ContextSuite context=TestRVPCSite2SiteVpn>:setup	Error	0.00	test_vpc_vpn.py
ContextSuite context=TestVPCSite2SiteVPNMultipleOptions>:setup	Error	0.00	test_vpc_vpn.py
ContextSuite context=TestVpcRemoteAccessVpn>:setup	Error	0.00	test_vpc_vpn.py
ContextSuite context=TestVpcSite2SiteVpn>:setup	Error	0.00	test_vpc_vpn.py
test_disable_oobm_ha_state_ineligible	Error	1519.89	test_hostha_kvm.py

[weizhouapache]

@Dogface2k
thanks for the PR.
Will you be using OVS/GRE in production?

I am also wondering if anyone else in the community is currently using OVS/GRE.
I was probably the last person to work on it in #5446, which was about five years ago...

[Dogface2k]

@Dogface2k thanks for the PR. Will you be using OVS/GRE in production?

I am also wondering if anyone else in the community is currently using OVS/GRE. I was probably the last person to work on it in #5446, which was about five years ago...

If you think this is no good for main/community just lmk and I'll remove it no worries. OVS/GRE are being used not by me personally but by someone who put this on a list for me to sort so yeah just lmk.

and I’m checking CloudStack 4.23’s native KVM VXLAN options

[Dogface2k]

@weizhouapache Thanks. Just to clarify where this came from OVS/GRE was on a list of CloudStack areas/issues given to me by someone else running CloudStack to look into. It isn't something from my own deployment. We use VMware NSX and aren't using OVS/GRE.

I've looked further into the alternatives as well. CloudStack's native KVM VXLAN path is separate from the OVS/GRE implementation. Native VXLAN provides the L2 overlay and network-isolation transport, but CloudStack does not use that native VXLAN path to implement its distributed VPC router. The OVS provider additionally maintains VPC-wide host/tier/VM topology, distributed gateway information and ACL/routing policy on each participating host. Therefore native KVM VXLAN is an alternative to OVS/GRE for basic overlay transport, but it is not a direct replacement for the distributed-router functionality exercised by this PR.

I'm not attached to OVS/GRE as a direction for CloudStack. The PR fixes issues in code CloudStack currently carries, but if there aren't meaningful users of that path anymore and the better direction is to deprecate or remove it rather than continue maintaining it, that's completely fine with me and I'll drop the PR. If OVS/GRE is still considered supported functionality, I'll continue with the testing and the fix.

[weizhouapache]

@weizhouapache Thanks. Just to clarify where this came from OVS/GRE was on a list of CloudStack areas/issues given to me by someone else running CloudStack to look into. It isn't something from my own deployment. We use VMware NSX and aren't using OVS/GRE.

I've looked further into the alternatives as well. CloudStack's native KVM VXLAN path is separate from the OVS/GRE implementation. Native VXLAN provides the L2 overlay and network-isolation transport, but CloudStack does not use that native VXLAN path to implement its distributed VPC router. The OVS provider additionally maintains VPC-wide host/tier/VM topology, distributed gateway information and ACL/routing policy on each participating host. Therefore native KVM VXLAN is an alternative to OVS/GRE for basic overlay transport, but it is not a direct replacement for the distributed-router functionality exercised by this PR.

I'm not attached to OVS/GRE as a direction for CloudStack. The PR fixes issues in code CloudStack currently carries, but if there aren't meaningful users of that path anymore and the better direction is to deprecate or remove it rather than continue maintaining it, that's completely fine with me and I'll drop the PR. If OVS/GRE is still considered supported functionality, I'll continue with the testing and the fix.

thanks @Dogface2k

Your PRs are always more than welcome. The feature is still supported, but it may not be widely used. Personally, I don't know of any users who are actively using it at the moment. So there is no need to withdraw the PR.