neutron: roll back Palo Alto interface wiring after post-create failures
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 45/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Active
- Tech stack
- python
- Domain
- networking
Research direction
Start by reading PR #2310 and the periodic agent reconciliation job, then trace the ROUTER_INTERFACE / BEFORE_CREATE callback through _add_router_port(). Add coverage for post-BEFORE_CREATE failures in attach-by-port and attach-by-subnet cases. Done means stale Palo Alto subport/trunk wiring is removed safely while shared resources remain intact and reconciliation is idempotent.
Written by the indexing model from the issue text.
Description
Follow-up to PR #2310. This is not intended to block merging that PR.
Problem
PR #2310 realizes Palo Alto interface wiring from the ROUTER_INTERFACE / BEFORE_CREATE callback and compensates through ABORT_CREATE. That abort event only covers failures raised by BEFORE_CREATE subscribers. Neutron can still fail afterward while _add_router_port() creates or validates the RouterPort association—for example, overlapping-subnet validation can reject the attachment.
For attach-by-port, Neutron restores the original port through an update rather than a deletion. In that failure window, Palo Alto subport/trunk wiring created by the callback can remain orphaned even though the router interface was not attached.
Follow-up approach
Handle this through the planned periodic agent reconciliation job rather than extending the synchronous API callback. The reconciler should treat Neutron state as desired state and repair or remove stale Palo Alto realization after the mechanism driver has completed.
Desired behavior
- Detect Palo Alto subport/trunk wiring for which no router-interface association exists.
- Remove only resources created for the stale attachment, preserving shared parent, trunk, VIF, gateway, and interface state still in use.
- Converge safely and idempotently across retries and partial failures.
- Add coverage for post-
BEFORE_CREATEfailures, including attach-by-port and attach-by-subnet.
Related: #2310.
- Dominant language
- Python
- Stars
- 13
- Forks
- 12
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 73
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rackerlabs/understack
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
rackerlabs/understack#2193 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 68/100
rackerlabs/understack#2346 ·
-
enhancement
Difficulty 5/5 Over a week Newbie friendliness 35/100
rackerlabs/understack#2343 ·
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 68/100
rackerlabs/understack#2342 ·
-
enhancement
Difficulty 4/5 3-5 days Newbie friendliness 72/100
rackerlabs/understack#2335 ·
All issues in rackerlabs/understack
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
enhancement
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100