Dogface2k opened a new issue, #13764:
URL: https://github.com/apache/cloudstack/issues/13764
<!--
Verify first that your issue/request is not already reported on GitHub.
Also test if the latest release and main branch are affected too.
Always add information AFTER of these HTML comments, but no need to delete
the comments.
-->
##### ISSUE TYPE
* Bug Report
##### COMPONENT NAME
~~~
VPC, VPN, NSX
~~~
##### CLOUDSTACK VERSION
~~~
4.22.0.0
4.22.1.0
main (verified at 4f117071c9397b1e4714c8fb61c384883c872842)
~~~
##### CONFIGURATION
Advanced zone with NSX-backed networking. VPC created from the seeded `VPC
offering with NSX - NAT Mode` offering.
##### OS / ENVIRONMENT
Live reproduction on CloudStack 4.22.1.0 with NSX 4.2.4 and VMware vSphere.
The same seed and gateway-selection paths are present on 4.22.0.0 and main.
##### SUMMARY
The seeded `VPC offering with NSX - NAT Mode` offering advertises the `Vpn`
service with provider `Nsx`, but the NSX element does not implement
`Site2SiteVpnServiceProvider`. The only production implementation of that
interface is `VpcVirtualRouterElement`.
`Site2SiteVpnManagerImpl.createVpnGateway` does not validate that the VPC
has a usable Site-to-Site VPN provider before selecting an endpoint IP. Its
`getIpAddressIdForVpn` path is hard-coded to `VPCVirtualRouter` service
mappings and otherwise requires exactly one source-NAT IP. An NSX NAT-mode VPC
has both its NSX Tier-1 source-NAT IP and a system-VM helper IP marked as
source NAT, so the lookup sees two rows and fails with the misleading error:
~~~
Request failed. (530)
Cannot found source nat ip of vpc <id>
~~~
This does not report the actual problem: the VPC offering advertises a
Site-to-Site VPN capability that no registered NSX provider implements.
The NSX public/system-VM IP arrangement is not changed by the proposed fix.
The required correction is to stop advertising `Vpn/Nsx` in this built-in
offering, remove that unsupported mapping from existing copies of the built-in
offering and its VPC snapshots during upgrade, and reject `createVpnGateway`
before IP lookup when `Vpn/VPCVirtualRouter` is not available.
No matching open or closed issue was found using the error text, offering
name, or affected manager method.
##### STEPS TO REPRODUCE
~~~
1. In an NSX-enabled advanced zone, create a VPC using:
VPC offering with NSX - NAT Mode
2. Verify the VPC offering/service snapshot maps Vpn to Nsx.
3. Call createVpnGateway for that VPC (or use the UI action).
4. The request fails after source-NAT IP lookup with:
Cannot found source nat ip of vpc <id>
~~~
The live database state showed two active source-NAT rows for the VPC, one
customer-visible NSX source-NAT IP and one `forsystemvms=1` helper IP. This is
why the legacy exactly-one lookup is reached, but the underlying defect is the
unusable `Vpn/Nsx` capability advertised by the seeded offering.
##### EXPECTED RESULTS
~~~
- The seeded NSX NAT-mode VPC offering advertises only services implemented
by its providers.
- Existing installations remove only the unsupported Vpn/Nsx mapping from
this exact built-in offering and VPCs created from it.
- createVpnGateway fails up front with a clear unsupported-capability error
when no VPCVirtualRouter VPN provider is mapped.
- Custom VPC offerings and Vpn/VPCVirtualRouter mappings are unchanged.
~~~
##### ACTUAL RESULTS
~~~
Request failed. (530)
Cannot found source nat ip of vpc <id>
~~~
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
