OVS: validate distributed VPC topology updates

[Dogface2k]

Summary

• scope OVS distributed-router topology and ACL updates to VPCs whose Connectivity provider is OVS;
• isolate each VPC's provider lookup and topology update so one unavailable or malformed VPC does not stop processing of later VPCs;
• validate active OVS topology inputs with actionable errors for invalid Vswitch broadcast keys and missing gateway NICs;
• preserve topology GRE keys as long values and validate the network GRE range declared by CloudStack, 0..4294967295;
• include only tiers in Setup, Implementing, or Implemented state in active topology generation, so allocated or teardown-state tiers are not treated as malformed;
• add focused unit coverage for provider ownership, per-VPC failure isolation, tier lifecycle filtering, GRE boundaries, malformed keys, and missing gateway NICs.

Behaviour and compatibility

The VM state listener can observe VPCs whose distributed routing is owned by another network provider. Those VPCs are now ignored by the OVS callback rather than receiving OVS topology updates. The ACL replacement subscriber applies the same provider ownership check.

Provider/VPC eligibility lookup is inside the per-VPC failure boundary. An exception while resolving or generating one VPC's topology is logged for that VPC, and subsequent VPCs continue to be processed.

The active-tier state filter matches the existing OVS VPC tunnel-creation lifecycle. Active tiers still require a Vswitch broadcast URI in the exact vpcId.greKey form and a gateway NIC.

Topology GRE keys are carried by the existing long field in OvsVpcPhysicalTopologyConfigCommand.Tier. Values above the signed integer range remain valid up to 4294967295, while negative, non-numeric, malformed, wrong-VPC, and above-range values fail before a topology command is produced.

No database schema, API contract, or non-OVS network implementation is changed.

Validation

OvsTunnelManagerImplTest covers:

• missing, non-distributed, non-OVS, and valid OVS VPC ownership;
• continuation to a valid OVS VPC after a non-OVS VPC, malformed topology, or provider lookup exception;
• allocated-tier exclusion and active-tier validation;
• accepted GRE keys 0, 2147483648, and 4294967295;
• rejection of negative, non-numeric, malformed, wrong-VPC, and above-range GRE keys;
• rejection of an active tier with no gateway NIC;
• valid topology and ACL-routing-policy generation paths.

[DaanHoogland]

clgtm

[codecov]

Codecov Report

❌ Patch coverage is 84.21053% with 6 lines in your changes missing coverage. Please review.
✅ Project coverage is 19.65%. Comparing base (4f11707) to head (42863fd).

Files with missing lines	Patch %	Lines
...va/com/cloud/network/ovs/OvsTunnelManagerImpl.java	84.21%	2 Missing and 4 partials ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##               main   #13792    +/-   ##
==========================================
  Coverage     19.65%   19.65%            
+ Complexity    19792    19766    -26     
==========================================
  Files          6368     6368            
  Lines        574881   575296   +415     
  Branches      70351    70359     +8     
==========================================
+ Hits         112970   113099   +129     
- Misses       449639   449909   +270     
- Partials      12272    12288    +16     

Flag	Coverage Δ
uitests	3.41% <ø> (ø)
unittests	20.93% <84.21%> (+<0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[DaanHoogland]

@blueorangutan package

[blueorangutan]

@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

[Copilot]

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Updates OVS distributed-router topology handling to scope updates to OVS-owned distributed VPCs, add validation for malformed topology inputs, and isolate per‑VPC failures so one bad VPC doesn’t abort processing.

Changes:

• Add isOvsDistributedRouterVpc(...) and use it to limit topology/policy updates to OVS connectivity VPCs.
• Wrap per‑VPC topology update work in try/catch to continue processing other VPCs on failures.
• Add validation and actionable exceptions for malformed Vswitch broadcast URI / broadcast key / missing gateway NIC, plus unit tests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.

File	Description
plugins/network-elements/ovs/src/main/java/com/cloud/network/ovs/OvsTunnelManagerImpl.java	Adds OVS-specific VPC filtering, per‑VPC failure containment, and stricter topology validation.
plugins/network-elements/ovs/src/test/java/com/cloud/network/ovs/OvsTunnelManagerImplTest.java	Adds focused unit coverage for OVS ownership checks, topology validation, and continuation behavior.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[blueorangutan]

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18775