Netris: Improvements and fixes to the Netris plugin by Pearl1594 · Pull Request #13591 · apache/cloudstack

Pearl1594 · 2026-07-10T14:34:36Z

Description

This PR addresses the following for Netris:

Support NAT, PF for Secondary IP
Support for L2 networks
CKS Support
Fix allocate vnets with the correct account ID so that release succeeds on network deletion
Add support to include VPN service for NATTED Netris offerings
Support Redundant Virtual Routers for Netris VPC networks
Enable autoscaling groups for Netris network offerings
Prevent re-adding ACLs
Add check for vnet name length and cleanup vpc and vnet resources on failure of creation of allocation
Add support to the VPC response to display if redundant routers are supported
Hide VPN sections and prevent enabling it when service isn't enabled in the vpc offering
Fix issue with adding external node to a CKS cluster with Netris offering
Update upgrade path to reclaim vnets of deleted netris networks, improve log and hide add upstream route for Netris routed networks
Allocate IP from Netris (Provider) range when IP is not specified during associate
Prevent VRRP gateway IP conflict on redundant VPC routers with external network providers (Netris/NSX)
VPN: Reconfigure static nat and static route on fail over to backup VR - for redundant VPC VRs
Fix issue with deletion of vpn connection for DualStack redundant VPCs

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

* Netris - Support NAT, PF for Secondary IP * Allow PF rules to be correctly created on secondary IP of a VM on netris * unique static nat names on netris by adding public IP - handle backward compatibility --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Support for L2 networks * Add support for L2 networks in Netris * remove the need to add connectivity to identify netris provider, remove changes to ui and create net offering * create vpc network and use it for l2 networks * dont fail if deletion on netris doesnt succeed * remove connectivity capability * update vpc name when l2 name is updated --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - CKS support Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Enable Global Routing Flag for NATTED Dual-Stack VPCs * Set globalRouting = true, when network offering is NATTED, dual-stack * update global routing based on routing mode and ip protocol type --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> * Netris - Fix allocate vnets with the correct account ID so that release succeeds on network deletion * Fix allocate vnets with the correct account ID so that release succeeds on network deletion * add fix for vpc tiers as well * move entire vnet cleanup logic to trash from shutdown, so that it works for all network types for netris * cleanup vnets when reservation id is null --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Add support to include VPN service for NATTED Netris offerings * Add support to include VPN service for NATTED Netris offerings * missing changes of global routing * Remove extra space --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> * Netris - Support Redundant Virtual Routers for Netris VPC networks * Add support for redundant routers for Netris VPC networks * address comment * default null network mode to natted for netris * preventing vpc and ipam creation if already exists --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Enable autoscaling groups for Netris network offerings * Enable autoscaling groups for Netris network offerings * Fix UI loading for services when network mode changes for external providers and show vm autoscaling always set to true / non-editable for netris when LB is selected i.e, natted mode * Revert removed comment --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> * merge conflict * systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris * show networks for vnf nic mappings --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> Co-authored-by: Wei Zhou <weizhou@apache.org>

* Netris - Support NAT, PF for Secondary IP * Allow PF rules to be correctly created on secondary IP of a VM on netris * unique static nat names on netris by adding public IP - handle backward compatibility --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Support for L2 networks * Add support for L2 networks in Netris * remove the need to add connectivity to identify netris provider, remove changes to ui and create net offering * create vpc network and use it for l2 networks * dont fail if deletion on netris doesnt succeed * remove connectivity capability * update vpc name when l2 name is updated --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - CKS support Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Enable Global Routing Flag for NATTED Dual-Stack VPCs * Set globalRouting = true, when network offering is NATTED, dual-stack * update global routing based on routing mode and ip protocol type --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> * Netris - Fix allocate vnets with the correct account ID so that release succeeds on network deletion * Fix allocate vnets with the correct account ID so that release succeeds on network deletion * add fix for vpc tiers as well * move entire vnet cleanup logic to trash from shutdown, so that it works for all network types for netris * cleanup vnets when reservation id is null --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Add support to include VPN service for NATTED Netris offerings * Add support to include VPN service for NATTED Netris offerings * missing changes of global routing * Remove extra space --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> * Netris - Support Redundant Virtual Routers for Netris VPC networks * Add support for redundant routers for Netris VPC networks * address comment * default null network mode to natted for netris * preventing vpc and ipam creation if already exists --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Enable autoscaling groups for Netris network offerings * Enable autoscaling groups for Netris network offerings * Fix UI loading for services when network mode changes for external providers and show vm autoscaling always set to true / non-editable for netris when LB is selected i.e, natted mode * Revert removed comment --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> * merge conflict * systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris * show networks for vnf nic mappings * Add a check to prevent re-adding existing ACLs * Add a check to prevent re-adding existing ACLs * change message compare statement --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> Co-authored-by: Wei Zhou <weizhou@apache.org>

…failure of creation of allocation * Netris - Support NAT, PF for Secondary IP * Allow PF rules to be correctly created on secondary IP of a VM on netris * unique static nat names on netris by adding public IP - handle backward compatibility --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Support for L2 networks * Add support for L2 networks in Netris * remove the need to add connectivity to identify netris provider, remove changes to ui and create net offering * create vpc network and use it for l2 networks * dont fail if deletion on netris doesnt succeed * remove connectivity capability * update vpc name when l2 name is updated --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - CKS support Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Enable Global Routing Flag for NATTED Dual-Stack VPCs * Set globalRouting = true, when network offering is NATTED, dual-stack * update global routing based on routing mode and ip protocol type --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> * Netris - Fix allocate vnets with the correct account ID so that release succeeds on network deletion * Fix allocate vnets with the correct account ID so that release succeeds on network deletion * add fix for vpc tiers as well * move entire vnet cleanup logic to trash from shutdown, so that it works for all network types for netris * cleanup vnets when reservation id is null --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Add support to include VPN service for NATTED Netris offerings * Add support to include VPN service for NATTED Netris offerings * missing changes of global routing * Remove extra space --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> * Netris - Support Redundant Virtual Routers for Netris VPC networks * Add support for redundant routers for Netris VPC networks * address comment * default null network mode to natted for netris * preventing vpc and ipam creation if already exists --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> * Netris - Enable autoscaling groups for Netris network offerings * Enable autoscaling groups for Netris network offerings * Fix UI loading for services when network mode changes for external providers and show vm autoscaling always set to true / non-editable for netris when LB is selected i.e, natted mode * Revert removed comment --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> * merge conflict * systemvm: fix VPC VPN issue when network id is bigger than 1000 on Netris * show networks for vnf nic mappings * Add a check to prevent re-adding existing ACLs * Add a check to prevent re-adding existing ACLs * change message compare statement * Add check for vnet name length and cleanup vpc and vnet resources on failure of creation of allocation * add name length validation to update path --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: nvazquez <nicovazquez90@gmail.com> Co-authored-by: Wei Zhou <weizhou@apache.org>

…upported Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

…in the vpc offering * Hide VPN sections and prevent enabling it when service isn't enabled in the vpc offering * update --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

…ring Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

…ove log and hide add upstream route for Netris routed networks * Update upgrade path to reclaim vnets of deleted netris networks, improve log and hide add upstream route for Netris routed networks * Apply suggestions from code review * hide upstream route banner for netris networks altogether * fix migration of netris VRs and fix reclaim vnet query --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com> Co-authored-by: Nicolas Vazquez <nicovazquez90@gmail.com>

…ing associate * Allocate IP from Netris (Provider) range when IP is not specified during associate * update javadoc and method name --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

codecov · 2026-07-10T14:39:19Z

Codecov Report

❌ Patch coverage is 6.10329% with 600 lines in your changes missing coverage. Please review.
✅ Project coverage is 17.99%. Comparing base (2e63c60) to head (c5ee6d1).

Files with missing lines	Patch %	Lines
...apache/cloudstack/service/NetrisApiClientImpl.java	0.00%	237 Missing ⚠️
...che/cloudstack/service/NetrisGuestNetworkGuru.java	14.28%	64 Missing and 8 partials ⚠️
...r/actionworkers/KubernetesClusterActionWorker.java	8.00%	46 Missing ⚠️
...er/actionworkers/KubernetesClusterStartWorker.java	0.00%	35 Missing ⚠️
.../actionworkers/KubernetesClusterDestroyWorker.java	0.00%	27 Missing ⚠️
...ain/java/com/cloud/network/vpc/VpcManagerImpl.java	0.00%	27 Missing ⚠️
...bernetes/cluster/KubernetesClusterManagerImpl.java	0.00%	22 Missing ⚠️
...er/actionworkers/KubernetesClusterScaleWorker.java	0.00%	18 Missing ⚠️
...ck/api/command/admin/vpc/CreateVPCOfferingCmd.java	0.00%	15 Missing ⚠️
...n/java/com/cloud/network/IpAddressManagerImpl.java	0.00%	15 Missing ⚠️
... and 17 more

Additional details and impacted files

@@             Coverage Diff              @@
##               4.22   #13591      +/-   ##
============================================
- Coverage     18.00%   17.99%   -0.02%     
- Complexity    16219    16223       +4     
============================================
  Files          5936     5936              
  Lines        535716   536200     +484     
  Branches      65596    65677      +81     
============================================
+ Hits          96459    96471      +12     
- Misses       428268   428730     +462     
- Partials      10989    10999      +10

Flag	Coverage Δ
uitests	`4.02% <ø> (-0.01%)`	⬇️
unittests	`19.06% <6.10%> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

nvazquez · 2026-07-10T16:23:45Z

@blueorangutan package

blueorangutan · 2026-07-10T16:26:04Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-07-10T17:25:21Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 18533

nvazquez · 2026-07-10T17:26:52Z

@blueorangutan test

blueorangutan · 2026-07-10T17:28:03Z

@nvazquez a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-07-11T09:05:57Z

[SF] Trillian test result (tid-16528)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 52917 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13591-t16528-kvm-ol8.zip
Smoke tests completed. 148 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
ContextSuite context=TestSharedNetworkWithConfigDrive>:setup	`Error`	48.34	test_network.py

sonarqubecloud · 2026-07-24T15:37:48Z

Quality Gate failed

Failed conditions
4.6% Coverage on New Code (required ≥ 40%)

See analysis details on SonarQube Cloud

…etwork providers (Netris/NSX) Co-authored-by: Pearl Dsilva <pearl1594@gmail.com>

…vements

…R - for redundant VPC VRs * VPN: Reconfigure static nat and static route on fail over to backup VR - for redundant VPC VRs * address comment * add stacktrace to the log ---------

Pearl1594 · 2026-09-15T19:39:31Z

@blueorangutan package

blueorangutan · 2026-09-15T19:40:05Z

@Pearl1594 a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-09-15T20:42:52Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19255

…vements

nvazquez · 2026-09-28T16:17:30Z

@blueorangutan package

nvazquez · 2026-09-29T10:15:52Z

@blueorangutan package

nvazquez · 2026-09-29T10:38:00Z

@blueorangutan package

blueorangutan · 2026-09-29T10:38:10Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-09-29T11:47:10Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19343

nvazquez · 2026-09-29T13:19:31Z

@blueorangutan test

blueorangutan · 2026-09-29T13:22:05Z

@nvazquez a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-09-30T05:17:22Z

[SF] Trillian test result (tid-17039)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 53722 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr13591-t17039-kvm-ol8.zip
Smoke tests completed. 146 look OK, 3 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
ContextSuite context=TestClusterDRS>:setup	`Error`	0.00	test_cluster_drs.py
test_list_system_vms_metrics_history	`Failure`	0.27	test_metrics_api.py
test_02_L2_persistent_network	`Failure`	102.00	test_persistent_network.py
test_03_deploy_and_destroy_VM_and_verify_network_resources_persist	`Failure`	142.86	test_persistent_network.py

nvazquez · 2026-09-30T17:51:29Z

@blueorangutan package

blueorangutan · 2026-09-30T17:52:05Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-09-30T18:53:09Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19359

sonarqubecloud · 2026-09-30T18:56:33Z

Quality Gate failed

Failed conditions
4.3% Coverage on New Code (required ≥ 40%)

See analysis details on SonarQube Cloud

Pearl1594 and others added 8 commits July 10, 2026 10:13

Add support to the VPC response to display if redundant routers are s…

34a15b5

…upported Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

Hide VPN sections and prevent enabling it when service isn't enabled …

f73bbdd

…in the vpc offering * Hide VPN sections and prevent enabling it when service isn't enabled in the vpc offering * update --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

Fix issue with adding external node to a CKS cluster with Netris offe…

98ae1c4

…ring Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

Allocate IP from Netris (Provider) range when IP is not specified dur…

0c0f22c

…ing associate * Allocate IP from Netris (Provider) range when IP is not specified during associate * update javadoc and method name --------- Co-authored-by: Pearl Dsilva <pearl1954@gmail.com>

Pearl1594 requested a review from nvazquez July 10, 2026 14:34

boring-cyborg Bot added component:api component:kubernetes component:networking component:orchestration component:UI component:vpc labels Jul 10, 2026

Pearl1594 added this to the 4.22.2 milestone Jul 10, 2026

nvazquez requested a review from kiranchavala July 10, 2026 17:26

boring-cyborg Bot added component:virtual-router Python Warning... Python code Ahead! labels Jul 24, 2026

DaanHoogland added this to CloudStack Testing Aug 31, 2026

github-project-automation Bot moved this to Backlog in CloudStack Testing Aug 31, 2026

DaanHoogland moved this from Backlog to conflict/waiting in CloudStack Testing Aug 31, 2026

Pearl1594 added 4 commits September 15, 2026 15:03

Fix VRRP gateway IP conflict on redundant VPC routers with external n…

049f9e9

…etwork providers (Netris/NSX) Co-authored-by: Pearl Dsilva <pearl1594@gmail.com>

Merge branch '4.22' of github.com:apache/cloudstack into netris-impro…

ab80f11

…vements

VPN: Reconfigure static nat and static route on fail over to backup V…

227122c

…R - for redundant VPC VRs * VPN: Reconfigure static nat and static route on fail over to backup VR - for redundant VPC VRs * address comment * add stacktrace to the log ---------

Fix issue with deletion of vpn connection for DualStack redundant VPCs

71f6299

Pearl1594 force-pushed the netris-improvements branch from 81b5274 to 71f6299 Compare September 15, 2026 19:11

fix precommit ci issue

5d8727b

Merge branch '4.22' of github.com:apache/cloudstack into netris-impro…

811c21b

…vements

nvazquez marked this pull request as ready for review September 29, 2026 14:27

Merge branch '4.22' into netris-improvements

c5ee6d1

Conversation

Pearl1594 commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

codecov Bot commented Jul 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

nvazquez commented Jul 10, 2026

Uh oh!

blueorangutan commented Jul 10, 2026

Uh oh!

blueorangutan commented Jul 10, 2026

Uh oh!

nvazquez commented Jul 10, 2026

Uh oh!

blueorangutan commented Jul 10, 2026

Uh oh!

blueorangutan commented Jul 11, 2026

Uh oh!

sonarqubecloud Bot commented Jul 24, 2026

Quality Gate failed

Uh oh!

Pearl1594 commented Sep 15, 2026

Uh oh!

blueorangutan commented Sep 15, 2026

Uh oh!

blueorangutan commented Sep 15, 2026

Uh oh!

nvazquez commented Sep 28, 2026

Uh oh!

nvazquez commented Sep 29, 2026

Uh oh!

nvazquez commented Sep 29, 2026

Uh oh!

blueorangutan commented Sep 29, 2026

Uh oh!

blueorangutan commented Sep 29, 2026

Uh oh!

nvazquez commented Sep 29, 2026

Uh oh!

blueorangutan commented Sep 29, 2026

Uh oh!

blueorangutan commented Sep 30, 2026

Uh oh!

nvazquez commented Sep 30, 2026

Uh oh!

blueorangutan commented Sep 30, 2026

Uh oh!

blueorangutan commented Sep 30, 2026

Uh oh!

sonarqubecloud Bot commented Sep 30, 2026

Quality Gate failed

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Pearl1594 commented Jul 10, 2026 •

edited

Loading

codecov Bot commented Jul 10, 2026 •

edited

Loading