network: scope routed network/VPC subnets to a zone by prashanthr2 · Pull Request #14421 · apache/cloudstack

prashanthr2 · 2026-10-16T12:02:25Z

Description

ip4_guest_subnet_network_map has no zone column, so the subnet bookkeeping for routed networks and VPCs is global. Creating a routed VPC or network with a CIDR that is already used in another zone fails with The subnet is in use, even though the two zones are independent.

This adds a nullable data_center_id to the table and scopes both the subnet lookup (findBySubnetAndDataCenterId) and the parentless overlap check (listAllNoParentByDataCenterId) by zone, so the same CIDR can be used once per zone. Existing rows are backfilled from their parent zone subnet, their VPC's zone_id, or their network's data_center_id.

Notes for reviewers:

The new FK gets ON DELETE CASCADE because IDEMPOTENT_ADD_FOREIGN_KEY hardcodes it. That matches networks, vpc, user_ip_address and most of the schema, though the sibling table dc_ip4_guest_subnets uses a plain FK.
Rows with no parent, no VPC and no network cannot be attributed to a zone and keep data_center_id = NULL. Those are leftovers from failed network/VPC creates (state = Free, unreferenced) and no longer take part in any zone's overlap check, which is the intended direction.

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
build/CI
test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Bug Severity

How Has This Been Tested?

Unit tests in RoutedIpv4ManagerImplTest updated for the new DAO signatures, plus a new testGetOrCreateIpv4SubnetForGuestNetworkOrVpcInternalByCidrInAnotherZone covering the cross-zone case.

Manual: create a routed VPC with 10.0.0.0/8 in zone 1, then a second routed VPC with the same CIDR in zone 2. Before this change the second create fails with "The subnet is in use"; after it, both succeed and each row in ip4_guest_subnet_network_map carries its own data_center_id.

🤖 Generated with Claude Code

https://claude.ai/code/session_017rnv8vT6LQSKfwkzp8tvg9

The ip4_guest_subnet_network_map table had no zone column, so the subnet bookkeeping for routed networks and VPCs was global. Creating a routed VPC or network with a CIDR already used in another zone failed with "The subnet is in use", even though the two zones are independent. Add a nullable data_center_id column to ip4_guest_subnet_network_map and scope the subnet lookup and the parentless overlap check by zone, so the same CIDR can be used once per zone. Existing rows are backfilled from their parent zone subnet, VPC or network. Fixes apache#14419 Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017rnv8vT6LQSKfwkzp8tvg9

weizhouapache

lgtm
the SQL may be applied to 423to24.sql too

codecov · 2026-10-16T12:50:34Z

Codecov Report

❌ Patch coverage is 45.83333% with 13 lines in your changes missing coverage. Please review.
✅ Project coverage is 18.02%. Comparing base (c7667d8) to head (cc80ffe).

Files with missing lines	Patch %	Lines
.../network/dao/Ipv4GuestSubnetNetworkMapDaoImpl.java	0.00%	6 Missing ⚠️
...loudstack/network/Ipv4GuestSubnetNetworkMapVO.java	37.50%	5 Missing ⚠️
...ache/cloudstack/network/RoutedIpv4ManagerImpl.java	80.00%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##               4.22   #14421      +/-   ##
============================================
- Coverage     18.03%   18.02%   -0.01%     
+ Complexity    16286    16282       -4     
============================================
  Files          5937     5937              
  Lines        536771   536782      +11     
  Branches      65782    65782              
============================================
- Hits          96787    96762      -25     
- Misses       428932   428968      +36     
  Partials      11052    11052

Flag	Coverage Δ
uitests	`4.04% <ø> (ø)`
unittests	`19.10% <45.83%> (-0.01%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Damans227 · 2026-10-16T13:39:09Z

    private Long parentId;

+    @Column(name = "data_center_id")
+    private Long dataCenterId;


should listing subnets by zone use this column too? right now it only matches through the zone subnet, so ones made without a zone subnet dont show up when you filter by zone

Good catch, thanks @Damans227 and it’s a bit worse than parentless rows. The zoneid filter resolves the zone through dc_ip4_guest_subnets:

List<DataCenterIpv4GuestSubnetVO> subnets = dataCenterIpv4GuestSubnetDao.listByDataCenterId(zoneId); if (CollectionUtils.isEmpty(subnets)) { return new ArrayList<>(); } sc.addAnd("parentId", SearchCriteria.Op.IN, parentIds.toArray());

So if the zone has no zone-level subnet configured at all, the list returns empty even when routed VPCs exist there , which is exactly the setup in #14419. createIpv4SubnetForGuestNetworkResponse has the same gap: zoneId is only derived from the network, VPC or parent, so a parentless unassigned row reports no zone.

Now that the row carries the zone, I’ll replace the parent-id lookup with a direct data_center_id filter and add it as a fallback in the response (that needs getDataCenterId() on the Ipv4GuestSubnetNetworkMap interface). Rows that predate the upgrade and can’t be attributed to a zone keep data_center_id = NULL and still won’t show under a zone filter same as today, so no regression. Pushing shortly.

Pushed in d98069c , filter now uses data_center_id, and the response falls back to it for parentless subnets.

that covers it, thanks

vladimirpetrov · 2026-10-16T14:41:37Z

@blueorangutan package

blueorangutan · 2026-10-16T14:42:06Z

@vladimirpetrov a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-10-16T15:35:24Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 19588

prashanthr2 · 2026-10-17T00:10:46Z

lgtm the SQL may be applied to 423to24.sql too

@weizhouapache Agreed. schema-42300to2400.sql only exists on main, so I can’t add it here , do you want me to raise a separate PR against main for it or will it be picked up in the forward-merge?

listIpv4SubnetsForGuestNetwork resolved the zoneid filter through dc_ip4_guest_subnets, so a subnet with no parent never matched, and a zone with no zone-level subnet returned an empty list. The response derived the zone the same way, leaving parentless subnets with no zone at all. Now that the record carries its zone, filter on data_center_id directly and fall back to it when building the response. Addresses review feedback on apache#14419. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_017rnv8vT6LQSKfwkzp8tvg9

Damans227

thanks @prashanthr2, fix looks right. LGTM

boring-cyborg Bot added the component:networking label Oct 16, 2026

vladimirpetrov added this to the 4.22.2 milestone Oct 16, 2026

weizhouapache approved these changes Oct 16, 2026

View reviewed changes

Damans227 reviewed Oct 16, 2026

View reviewed changes

boring-cyborg Bot added the component:api label Oct 17, 2026

Damans227 approved these changes Oct 17, 2026

View reviewed changes

Navigation Menu

Repository navigation

network: scope routed network/VPC subnets to a zone - #14421

network: scope routed network/VPC subnets to a zone#14421
prashanthr2 wants to merge 2 commits into
apache:4.22from
prashanthr2:routed-vpc-cidr-per-zone

prashanthr2 commented Oct 16, 2026

Uh oh!

weizhouapache left a comment

Uh oh!

codecov Bot commented Oct 16, 2026 •

edited

Loading

Uh oh!

Damans227 Oct 16, 2026

Uh oh!

prashanthr2 Oct 17, 2026

Uh oh!

prashanthr2 Oct 17, 2026

Uh oh!

Damans227 Oct 17, 2026

Uh oh!

vladimirpetrov commented Oct 16, 2026

Uh oh!

blueorangutan commented Oct 16, 2026

Uh oh!

blueorangutan commented Oct 16, 2026

Uh oh!

prashanthr2 commented Oct 17, 2026

Uh oh!

Damans227 left a comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

prashanthr2 commented Oct 16, 2026

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Bug Severity

How Has This Been Tested?

Uh oh!

weizhouapache left a comment

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Oct 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Damans227 Oct 16, 2026

Choose a reason for hiding this comment

Uh oh!

prashanthr2 Oct 17, 2026

Choose a reason for hiding this comment

Uh oh!

prashanthr2 Oct 17, 2026

Choose a reason for hiding this comment

Uh oh!

Damans227 Oct 17, 2026

Choose a reason for hiding this comment

Uh oh!

vladimirpetrov commented Oct 16, 2026

Uh oh!

blueorangutan commented Oct 16, 2026

Uh oh!

blueorangutan commented Oct 16, 2026

Uh oh!

prashanthr2 commented Oct 17, 2026

Uh oh!

Damans227 left a comment

Choose a reason for hiding this comment

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

codecov Bot commented Oct 16, 2026 •

edited

Loading