Netris: Improvements and fixes to the Netris plugin

api/src/main/java/com/cloud/network/netris/NetrisService.java

@@ -21,6 +21,8 @@
 import com.cloud.network.SDNProviderNetworkRule;
 import com.cloud.network.vpc.StaticRoute;
 import com.cloud.network.vpc.Vpc;
+import com.cloud.offering.NetworkOffering;
+import com.cloud.utils.net.NetUtils;
 
 import java.util.List;
 
@@ -81,18 +83,20 @@
     /**
      * Creates a virtual network (vNet) resource.
      *
-     * @param zoneId           the ID of the zone
-     * @param accountId        the ID of the account
-     * @param domainId         the ID of the domain
-     * @param vpcName          the name of the VPC
-     * @param vpcId            the ID of the VPC
-     * @param networkName      the name of the network
-     * @param networkId        the ID of the network
-     * @param cidr             the CIDR of the network
-     * @param globalRouting    true if global routing is enabled
+     * @param zoneId            the ID of the zone
+     * @param accountId         the ID of the account
+     * @param domainId          the ID of the domain
+     * @param vpcName           the name of the VPC
+     * @param vpcId             the ID of the VPC
+     * @param networkName       the name of the network
+     * @param networkId         the ID of the network
+     * @param cidr              the CIDR of the network
+     * @param networkMode       the network mode
+     * @param internetProtocol  the internet protocol
+     * @param isL2              true if it is an L2 network
      * @return true if the operation is successful, false otherwise
      */
-    boolean createVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, Boolean globalRouting);
+    boolean createVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, NetworkOffering.NetworkMode networkMode, NetUtils.InternetProtocol internetProtocol, boolean isL2);
 
     /**
      * Updates an existing vNet resource.
@@ -105,9 +109,10 @@
      * @param networkName     the new name of the network
      * @param networkId       the ID of the network
      * @param prevNetworkName the previous name of the network
+     * @param isL2            true if it is an L2 network
      * @return true if the operation is successful, false otherwise
      */
-    boolean updateVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String prevNetworkName);
+    boolean updateVnetResource(Long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String prevNetworkName, boolean isL2);
 
     /**
      * Deletes an existing vNet resource.
@@ -120,9 +125,10 @@
      * @param networkName  the name of the network
      * @param networkId    the ID of the network
      * @param cidr         the CIDR of the network
+     * @param isL2         true if it is an L2 network
      * @return true if the operation is successful, false otherwise
      */
-    boolean deleteVnetResource(long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr);
+    boolean deleteVnetResource(long zoneId, long accountId, long domainId, String vpcName, Long vpcId, String networkName, Long networkId, String cidr, boolean isL2);
 
     /**
      * Creates a source NAT rule for a VPC or network.

api/src/main/java/org/apache/cloudstack/api/ApiConstants.java

@@ -1288,6 +1288,7 @@ public class ApiConstants {
     public static final String HAS_RULES = "hasrules";
     public static final String NSX_DETAIL_KEY = "forNsx";
     public static final String NETRIS_DETAIL_KEY = "forNetris";
+    public static final String NETRIS_NAT_PUBLIC_IP_ID = "netrisnatpublicipid";
     public static final String NETRIS_TAG = "netristag";
     public static final String NETRIS_VXLAN_ID = "netrisvxlanid";
     public static final String NETRIS_URL = "netrisurl";

api/src/main/java/org/apache/cloudstack/api/command/admin/network/CreateNetworkOfferingCmd.java

@@ -60,6 +60,7 @@
 import static com.cloud.network.Network.Service.NetworkACL;
 import static com.cloud.network.Network.Service.UserData;
 import static com.cloud.network.Network.Service.Firewall;
+import static com.cloud.network.Network.Service.Vpn;
 
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetrisNatted;
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetrisRouted;
@@ -309,6 +310,10 @@ public List<String> getSupportedServices() {
             } else {
                 services.add(Firewall.getName());
             }
+
+            if (isNetrisNatted(getProvider(), getNetworkMode())) {
+                services.add(Vpn.getName());
+            }
             return services;
         }
     }
@@ -418,6 +423,9 @@ else if (NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(getNetworkMo
                 serviceProviderMap.remove(Lb.getName());
             }
         }
+        if (isNetrisNatted(getProvider(), getNetworkMode())) {
+            serviceProviderMap.put(Vpn.getName(), List.of(routerProvider));
+        }
     }
 
     public Map<Capability, String> getServiceCapabilities(Service service) {

api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/CreateVPCOfferingCmd.java

@@ -24,6 +24,7 @@
 import java.util.LinkedHashSet;
 import java.util.List;
 import java.util.Map;
+import java.util.Objects;
 import java.util.Set;
 import java.util.stream.Collectors;
 import java.util.stream.Stream;
@@ -61,7 +62,9 @@
 import static com.cloud.network.Network.Service.NetworkACL;
 import static com.cloud.network.Network.Service.UserData;
 import static com.cloud.network.Network.Service.Gateway;
+import static com.cloud.network.Network.Service.Vpn;
 
+import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetris;
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetrisNatted;
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNetrisRouted;
 import static org.apache.cloudstack.api.command.utils.OfferingUtils.isNsxWithoutLb;
@@ -189,7 +192,7 @@
                     NetworkACL.getName(),
                     UserData.getName()
                     ));
-            if (NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(getNetworkMode())) {
+            if (isNetrisNatted(getProvider(), getNetworkMode())) {
                 supportedServices.addAll(Arrays.asList(
                         StaticNat.getName(),
                         SourceNat.getName(),
@@ -198,9 +201,13 @@
             if (NetworkOffering.NetworkMode.ROUTED.name().equalsIgnoreCase(getNetworkMode())) {
                 supportedServices.add(Gateway.getName());
             }
+
             if (getNsxSupportsLbService() || isNetrisNatted(getProvider(), getNetworkMode())) {
                 supportedServices.add(Lb.getName());
             }
+            if (isNetrisNatted(getProvider(), getNetworkMode())) {
+                supportedServices.add(Vpn.getName());
+            }
         }
         return supportedServices;
     }
@@ -210,7 +217,7 @@
     }
 
     public String getNetworkMode() {
-        return networkMode;
+        return isNetris(getProvider()) && Objects.isNull(networkMode) ? NetworkOffering.NetworkMode.NATTED.name() : networkMode;
     }
 
     public boolean getNsxSupportsLbService() {
@@ -228,7 +235,7 @@
                     logger.trace("service provider entry specified: " + obj);
                 }
                 HashMap<String, String> services = (HashMap<String, String>) obj;
                 String service = services.get("service");
                 String provider = services.get("provider");
                 List<String> providerList = null;
                 if (serviceProviderMap.containsKey(service)) {
@@ -248,7 +255,7 @@
 
     private void getServiceProviderMapForExternalProvider(Map<String, List<String>> serviceProviderMap, String provider) {
         List<String> unsupportedServices = new ArrayList<>(List.of("Vpn", "BaremetalPxeService", "SecurityGroup", "Connectivity", "Firewall"));
-        if (NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(getNetworkMode())) {
+        if (isNetrisNatted(getProvider(), getNetworkMode())) {
             unsupportedServices.add("Gateway");
         }
         List<String> routerSupported = List.of("Dhcp", "Dns", "UserData");
@@ -258,7 +265,7 @@
                 continue;
             if (routerSupported.contains(service))
                 serviceProviderMap.put(service, List.of(VirtualRouterProvider.Type.VPCVirtualRouter.name()));
-            else if (NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(getNetworkMode()) ||
+            else if (isNetrisNatted(getProvider(), getNetworkMode()) ||
                     Stream.of(NetworkACL.getName(), Gateway.getName()).anyMatch(s -> s.equalsIgnoreCase(service))) {
                 serviceProviderMap.put(service, List.of(provider));
             }
@@ -268,7 +275,20 @@
         }
     }
 
+    @SuppressWarnings("unchecked")
     public Map<String, List<String>> getServiceCapabilityList() {
+        // For Netris NATTED, Gateway service is excluded so the redundant-router capability
+        // must reference SourceNat (not Gateway).
+        if (serviceCapabilityList != null
+                && isNetrisNatted(getProvider(), getNetworkMode())) {
+            for (Object capEntry : serviceCapabilityList.values()) {
+                Map<String, String> cap = (Map<String, String>) capEntry;
+                if (Network.Capability.RedundantRouter.getName().equalsIgnoreCase(cap.get("capabilitytype"))
+                        && Gateway.getName().equalsIgnoreCase(cap.get("service"))) {
+                    cap.put("service", SourceNat.getName());
+                }
+            }
+        }
         return serviceCapabilityList;
     }
 

api/src/main/java/org/apache/cloudstack/api/command/utils/OfferingUtils.java

@@ -23,8 +23,12 @@ public class OfferingUtils {
     private OfferingUtils() {
     }
 
+    public static boolean isNetris(String provider) {
+        return "Netris".equalsIgnoreCase(provider);
+    }
+
     public static boolean isNetrisNatted(String provider, String networkMode) {
-        return "Netris".equalsIgnoreCase(provider) &&
+        return isNetris(provider) &&
                NetworkOffering.NetworkMode.NATTED.name().equalsIgnoreCase(networkMode);
     }
 
@@ -33,6 +37,6 @@ public static boolean isNsxWithoutLb(String provider, boolean nsxSupportsLbServi
     }
 
     public static boolean isNetrisRouted(String provider, String networkMode) {
-        return "Netris".equalsIgnoreCase(provider) && NetworkOffering.NetworkMode.ROUTED.name().equalsIgnoreCase(networkMode);
+        return isNetris(provider) && NetworkOffering.NetworkMode.ROUTED.name().equalsIgnoreCase(networkMode);
     }
 }

api/src/main/java/org/apache/cloudstack/api/response/VpcOfferingResponse.java

@@ -62,6 +62,10 @@ public class VpcOfferingResponse extends BaseResponse {
     @Param(description = "Indicates if the VPC offering supports distributed router for one-hop forwarding", since = "4.4")
     private Boolean supportsDistributedRouter;
 
+    @SerializedName(ApiConstants.REDUNDANT_ROUTER)
+    @Param(description = "Indicates if the VPC offering supports redundant routers")
+    private Boolean redundantRouter;
+
     @SerializedName((ApiConstants.SUPPORTS_REGION_LEVEL_VPC))
     @Param(description = "Indicated if the offering can support region level VPC", since = "4.4")
     private Boolean supportsRegionLevelVpc;
@@ -201,4 +205,8 @@ public String getRoutingMode() {
     public void setRoutingMode(String routingMode) {
         this.routingMode = routingMode;
     }
+
+    public void setRedundantRouter(Boolean redundantRouter) {
+        this.redundantRouter = redundantRouter;
+    }
 }

engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java

@@ -2302,6 +2302,11 @@ public void prepareNicForMigration(final VirtualMachineProfile vm, final DeployD
         }
     }
 
+    private boolean isReservedForExternalProvider(Long vlanId) {
+        VlanDetailsVO vlanDetail = vlanDetailsDao.findDetail(vlanId, ApiConstants.NETRIS_DETAIL_KEY);
+        return vlanDetail != null && BooleanUtils.toBoolean(vlanDetail.getValue());
+    }
+
     /*
     Prepare All Nics for migration including the nics dynamically created and not stored in DB
     This is a temporary workaround work KVM migration
@@ -2350,6 +2355,10 @@ public void prepareAllNicsForMigration(final VirtualMachineProfile vm, final Dep
             final List<IPAddressVO> publicIps = _ipAddressDao.listByAssociatedNetwork(guestNetworkId, null);
             for (final IPAddressVO userIp : publicIps) {
                 final PublicIp publicIp = PublicIp.createFromAddrAndVlan(userIp, _vlanDao.findById(userIp.getVlanId()));
+                if (isReservedForExternalProvider(publicIp.getVlanId())) {
+                    logger.debug("Skipping public IP {} for migration NIC profile: managed by external network provider", publicIp.getAddress());
+                    continue;
+                }
                 final URI broadcastUri = BroadcastDomainType.Vlan.toUri(publicIp.getVlanTag());
                 final long ntwkId = publicIp.getNetworkId();
                 final Nic nic = _nicDao.findByNetworkIdInstanceIdAndBroadcastUri(ntwkId, vm.getId(),
@@ -3173,9 +3182,10 @@ private boolean hasGuestBypassVlanOverlapCheck(final boolean bypassVlanOverlapCh
     }
 
     /**
-     * Checks for L2 network offering services. Only 2 cases allowed:
+     * Checks for L2 network offering services. Only 3 cases allowed:
      * - No services
-     * - User Data service only, provided by ConfigDrive
+     * - UserData service only, provided by ConfigDrive
+     * - Connectivity service only, provided by Netris
      *
      * @param ntwkOff network offering
      */

engine/schema/src/main/resources/META-INF/db/schema-42200to42210.sql

@@ -59,3 +59,11 @@ UPDATE `cloud`.`configuration`
 SET value = CONCAT_WS('\n', 'Hello {{username}}!', 'You have requested to reset your password. Please click the following link to reset your password:', '{{{resetLink}}}', 'If you did not request a password reset, please ignore this email.', '', 'Regards,', 'The CloudStack Team')
 WHERE name = 'user.password.reset.mail.template'
   AND value IN (CONCAT_WS('\n', 'Hello {{username}}!', 'You have requested to reset your password. Please click the following link to reset your password:', 'http://{{{resetLink}}}', 'If you did not request a password reset, please ignore this email.', '', 'Regards,', 'The CloudStack Team'), CONCAT_WS('\n', 'Hello {{username}}!', 'You have requested to reset your password. Please click the following link to reset your password:', '{{{domainUrl}}}{{{resetLink}}}', 'If you did not request a password reset, please ignore this email.', '', 'Regards,', 'The CloudStack Team'));
+
+-- Reclaim VNETs belonging to Netris deleted networks
+UPDATE op_dc_vnet_alloc a
+    JOIN networks n ON n.broadcast_uri = CONCAT('netris://', a.vnet)
+    SET a.account_id = NULL,
+        a.reservation_id = NULL,
+        a.taken = NULL
+WHERE n.removed IS NOT NULL;