dheeraj12347 opened a new pull request, #12850:
URL: https://github.com/apache/cloudstack/pull/12850
## Problem
During KVM VM cleanup, `security_group.py` tries to flush and delete
iptables/ip6tables chains and ipsets unconditionally. If the chain or set has
already been removed (for example, when cleanup is rerun or after partial
failures), the underlying commands fail, and the agent logs misleading ERROR
messages and stack traces, even though there is nothing left to clean up. This
makes idempotent cleanup noisy and harder to debug. [web:2]
## Changes
- Added helper functions:
- `iptables_chain_exists(chain)`
- `ip6tables_chain_exists(chain)`
- `ipset_exists(setname)`
These use the existing `execute()` wrapper to check whether a chain or
ipset exists. Exit code 1 (not found) is treated as a normal condition: it is
logged at DEBUG and returns `False`, while other non‑zero exit codes are still
raised as real errors. [file:69]
- Updated `destroy_network_rules_for_vm()` to:
- Check iptables and ip6tables chain existence via the new helpers before
flushing and deleting them.
- Check IPv4 and IPv6 ipset existence before flushing and deleting them.
- Log missing chains and ipsets at DEBUG level as “does not exist,
skipping”.
- Keep logging real failures when flushing/deleting chains or ipsets at
ERROR level.
- Preserve existing behavior for ebtables cleanup, DNAT rule removal, and
rule/log file cleanup. [file:69]
## Result
- VM cleanup for KVM is now idempotent and no longer emits misleading ERROR
logs when chains or ipsets are already gone.
- Real failures during cleanup are still surfaced as ERROR messages with
details, improving signal‑to‑noise in agent logs. [file:69][web:2]
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
