This is an automated email from the ASF dual-hosted git repository.
RosiKyu pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/cloudstack.git
The following commit(s) were added to refs/heads/main by this push:
new c76c01e21a1 network: add default isolated offering with source NAT and
egress allowed by default (#14286)
c76c01e21a1 is described below
commit c76c01e21a1d98fbdcb5da051d7336838873eeb0
Author: Wei Zhou <[email protected]>
AuthorDate: Tue Oct 20 18:17:36 2026 +0200
network: add default isolated offering with source NAT and egress allowed
by default (#14286)
* network: add default isolated offering with source NAT and egress allowed
by default
Adds a new default network offering,
DefaultIsolatedNetworkOfferingWithSourceNatServiceEgressAllowed: an
isolated offering with the SourceNat service whose default egress policy
allows traffic, so VMs on it can reach outbound networks without an
explicit egress rule.
- NetworkOffering: declare the offering's unique name constant.
- NetworkOrchestrator: create the offering (Availability.Optional,
egressDefaultPolicy=true) on zones that do not have it yet.
- ConfigurationServerImpl: create the offering, its service map, and set
its state to Enabled with VM autoscaling and egress-default-policy
support during first-time setup.
- NetworkOfferingVO: rename the egressdefaultpolicy field to
egressDefaultPolicy and add a setter so the policy can be set before
the offering is persisted.
* network: align upgraded default egress-allowed offering with fresh
install (PR 14286)
The offering created at management server startup on upgraded setups used
the capability-map defaults, so it had no dedicated LB, no associate public
IP and no VM autoscaling support, and a multicast rate of 10. Set the same
values as the fresh-install path in ConfigurationServerImpl.
* rename to setEipAssociatePublicIp (PR 14286)
* network: rename default egress allowed offering constant and disable
keep-alive (PR 14286)
Drop "Default" from the constant name so that it matches the offering name,
and create the offering on upgraded setups with keep-alive disabled, like
the other default offerings and the API default.
* network: address review comments on the egress allowed offering (PR 14286)
Rename the NetworkOfferingVO constructor parameter egressdefaultpolicy to
egressDefaultPolicy to match the field, and log the service instead of the
whole service map entry in the default offering trace messages.
---
.../java/com/cloud/offering/NetworkOffering.java | 1 +
.../engine/orchestration/NetworkOrchestrator.java | 42 +++++++++++++++-------
.../com/cloud/offerings/NetworkOfferingVO.java | 20 +++++++----
.../com/cloud/server/ConfigurationServerImpl.java | 19 +++++++++-
4 files changed, 62 insertions(+), 20 deletions(-)
diff --git a/api/src/main/java/com/cloud/offering/NetworkOffering.java
b/api/src/main/java/com/cloud/offering/NetworkOffering.java
index 5000a4f8c62..159c1e2fe31 100644
--- a/api/src/main/java/com/cloud/offering/NetworkOffering.java
+++ b/api/src/main/java/com/cloud/offering/NetworkOffering.java
@@ -70,6 +70,7 @@ public interface NetworkOffering extends
InfrastructureEntity, InternalIdentity,
public static final String DEFAULT_ROUTED_NSX_OFFERING =
"DefaultRoutedNSXNetworkOffering";
public final static String QuickCloudNoServices = "QuickCloudNoServices";
public final static String
DefaultIsolatedNetworkOfferingWithSourceNatService =
"DefaultIsolatedNetworkOfferingWithSourceNatService";
+ public final static String
DefaultIsolatedNetworkOfferingWithSourceNatServiceEgressAllowed =
"DefaultIsolatedNetworkOfferingWithSourceNatServiceEgressAllowed";
public final static String OvsIsolatedNetworkOfferingWithSourceNatService
= "OvsIsolatedNetworkOfferingWithSourceNatService";
public final static String DefaultSharedNetworkOffering =
"DefaultSharedNetworkOffering";
public final static String DefaultIsolatedNetworkOffering =
"DefaultIsolatedNetworkOffering";
diff --git
a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
index 0b28d070ae2..c1697819174 100644
---
a/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
+++
b/engine/orchestration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
@@ -581,19 +581,19 @@ public class NetworkOrchestrator extends ManagerBase
implements NetworkOrchestra
defaultIsolatedSourceNatEnabledNetworkOfferingProviders.put(Service.Vpn,
defaultProviders);
final Map<Network.Service, Set<Network.Provider>>
defaultVPCOffProviders = new HashMap<>();
- defaultProviders.clear();
- defaultProviders.add(Network.Provider.VPCVirtualRouter);
- defaultVPCOffProviders.put(Service.Dhcp, defaultProviders);
- defaultVPCOffProviders.put(Service.Dns, defaultProviders);
- defaultVPCOffProviders.put(Service.UserData, defaultProviders);
- defaultVPCOffProviders.put(Service.NetworkACL, defaultProviders);
- defaultVPCOffProviders.put(Service.Gateway, defaultProviders);
- defaultVPCOffProviders.put(Service.Lb, defaultProviders);
- defaultVPCOffProviders.put(Service.SourceNat, defaultProviders);
- defaultVPCOffProviders.put(Service.StaticNat, defaultProviders);
- defaultVPCOffProviders.put(Service.PortForwarding, defaultProviders);
- defaultVPCOffProviders.put(Service.Vpn, defaultProviders);
- defaultVPCOffProviders.put(Service.Firewall, defaultProviders);
+ final Set<Network.Provider> defaultVpcProviders = new HashSet<>();
+ defaultVpcProviders.add(Network.Provider.VPCVirtualRouter);
+ defaultVPCOffProviders.put(Service.Dhcp, defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.Dns, defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.UserData, defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.NetworkACL, defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.Gateway, defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.Lb, defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.SourceNat, defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.StaticNat, defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.PortForwarding,
defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.Vpn, defaultVpcProviders);
+ defaultVPCOffProviders.put(Service.Firewall, defaultVpcProviders);
Transaction.execute(new TransactionCallbackNoReturn() {
@Override
@@ -636,6 +636,22 @@ public class NetworkOrchestrator extends ManagerBase
implements NetworkOrchestra
true, false, false, false, false, null, null,
null, true, null, null, false);
}
+ //#4-2 - default isolated offering with Source nat service and
egress traffic allowed by default
+ if
(_networkOfferingDao.findByUniqueName(NetworkOffering.DefaultIsolatedNetworkOfferingWithSourceNatServiceEgressAllowed)
== null) {
+ offering =
_configMgr.createNetworkOffering(NetworkOffering.DefaultIsolatedNetworkOfferingWithSourceNatServiceEgressAllowed,
+ "Offering for Isolated networks with Source Nat
service enabled and egress traffic allowed by default", TrafficType.Guest,
null, false, Availability.Optional, null,
+
defaultIsolatedSourceNatEnabledNetworkOfferingProviders, true,
Network.GuestType.Isolated, false, null, true, null, false, false, null, true,
null,
+ true, false, false, false, false, null, null,
null, true, null, null, false);
+ // keep consistent with the offering created on fresh
installation (ConfigurationServerImpl)
+ offering.setMulticastRateMbps(null);
+ offering.setDedicatedLB(true);
+ offering.setEipAssociatePublicIp(true);
+ offering.setSupportsVmAutoScaling(true);
+ offering.setEgressDefaultPolicy(true);
+ offering.setKeepAliveEnabled(false);
+ _networkOfferingDao.update(offering.getId(), offering);
+ }
+
//#5 - default vpc offering with LB service
if
(_networkOfferingDao.findByUniqueName(NetworkOffering.DefaultIsolatedNetworkOfferingForVpcNetworks)
== null) {
offering =
_configMgr.createNetworkOffering(NetworkOffering.DefaultIsolatedNetworkOfferingForVpcNetworks,
diff --git
a/engine/schema/src/main/java/com/cloud/offerings/NetworkOfferingVO.java
b/engine/schema/src/main/java/com/cloud/offerings/NetworkOfferingVO.java
index fc22e68985d..c9dc0723632 100644
--- a/engine/schema/src/main/java/com/cloud/offerings/NetworkOfferingVO.java
+++ b/engine/schema/src/main/java/com/cloud/offerings/NetworkOfferingVO.java
@@ -138,7 +138,7 @@ public class NetworkOfferingVO implements NetworkOffering {
NetworkMode networkMode;
@Column(name = "egress_default_policy")
- boolean egressdefaultpolicy;
+ boolean egressDefaultPolicy;
@Column(name = "concurrent_connections")
Integer concurrentConnections;
@@ -343,12 +343,16 @@ public class NetworkOfferingVO implements NetworkOffering
{
@Override
public boolean isEgressDefaultPolicy() {
- return egressdefaultpolicy;
+ return egressDefaultPolicy;
+ }
+
+ public void setEgressDefaultPolicy(boolean egressDefaultPolicy) {
+ this.egressDefaultPolicy = egressDefaultPolicy;
}
public NetworkOfferingVO(String name, String displayText, TrafficType
trafficType, boolean systemOnly, boolean specifyVlan, Integer rateMbps,
- Integer multicastRateMbps, boolean isDefault, Availability
availability, String tags, Network.GuestType guestType, boolean conserveMode,
- boolean specifyIpRanges, boolean isPersistent, boolean internalLb,
boolean publicLb, boolean isForVpc) {
+ Integer multicastRateMbps, boolean isDefault,
Availability availability, String tags, Network.GuestType guestType, boolean
conserveMode,
+ boolean specifyIpRanges, boolean isPersistent,
boolean internalLb, boolean publicLb, boolean isForVpc) {
this.name = name;
this.displayText = displayText;
this.rateMbps = rateMbps;
@@ -380,7 +384,7 @@ public class NetworkOfferingVO implements NetworkOffering {
public NetworkOfferingVO(String name, String displayText, TrafficType
trafficType, boolean systemOnly, boolean specifyVlan, Integer rateMbps,
Integer multicastRateMbps, boolean isDefault, Availability
availability, String tags, Network.GuestType guestType, boolean conserveMode,
boolean dedicatedLb,
boolean sharedSourceNat, boolean redundantRouter, boolean
elasticIp, boolean elasticLb, boolean specifyIpRanges, boolean inline, boolean
isPersistent,
- boolean associatePublicIP, boolean publicLb, boolean internalLb,
boolean isForVpc, boolean egressdefaultpolicy, boolean supportsStrechedL2,
boolean supportsPublicAccess) {
+ boolean associatePublicIP, boolean publicLb, boolean internalLb,
boolean isForVpc, boolean egressDefaultPolicy, boolean supportsStrechedL2,
boolean supportsPublicAccess) {
this(name,
displayText,
trafficType,
@@ -404,7 +408,7 @@ public class NetworkOfferingVO implements NetworkOffering {
this.elasticLb = elasticLb;
this.inline = inline;
this.eipAssociatePublicIp = associatePublicIP;
- this.egressdefaultpolicy = egressdefaultpolicy;
+ this.egressDefaultPolicy = egressDefaultPolicy;
this.supportsStrechedL2 = supportsStrechedL2;
this.supportsPublicAccess = supportsPublicAccess;
}
@@ -488,6 +492,10 @@ public class NetworkOfferingVO implements NetworkOffering {
return eipAssociatePublicIp;
}
+ public void setEipAssociatePublicIp(boolean eipAssociatePublicIp) {
+ this.eipAssociatePublicIp = eipAssociatePublicIp;
+ }
+
@Override
public boolean isElasticLb() {
return elasticLb;
diff --git a/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
b/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
index def564dfdc6..1f48967b253 100644
--- a/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
+++ b/server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
@@ -1070,12 +1070,29 @@ public class ConfigurationServerImpl extends
ManagerBase implements Configuratio
defaultIsolatedSourceNatEnabledNetworkOffering.setSupportsVmAutoScaling(true);
defaultIsolatedSourceNatEnabledNetworkOffering =
_networkOfferingDao.persistDefaultNetworkOffering(defaultIsolatedSourceNatEnabledNetworkOffering);
+ // Offering #3-2
+ NetworkOfferingVO
defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed =
+ new
NetworkOfferingVO(NetworkOffering.DefaultIsolatedNetworkOfferingWithSourceNatServiceEgressAllowed,
+ "Offering for Isolated networks with Source
Nat service enabled and egress traffic allowed by default", TrafficType.Guest,
false, false, null, null, true, Availability.Optional, null,
+ Network.GuestType.Isolated, true, false,
false, false, true, false);
+
+
defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.setState(NetworkOffering.State.Enabled);
+
defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.setSupportsVmAutoScaling(true);
+
defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.setEgressDefaultPolicy(true);
+
defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed =
_networkOfferingDao.persistDefaultNetworkOffering(defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed);
+
for (Service service :
defaultIsolatedSourceNatEnabledNetworkOfferingProviders.keySet()) {
NetworkOfferingServiceMapVO offService =
new
NetworkOfferingServiceMapVO(defaultIsolatedSourceNatEnabledNetworkOffering.getId(),
service,
defaultIsolatedSourceNatEnabledNetworkOfferingProviders.get(service));
_ntwkOfferingServiceMapDao.persist(offService);
- logger.trace("Added service for the network offering: " +
offService);
+ logger.trace("Added service {} for the network offering:
{}", service, defaultIsolatedSourceNatEnabledNetworkOffering.getUniqueName());
+
+ offService =
+ new
NetworkOfferingServiceMapVO(defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.getId(),
service,
+
defaultIsolatedSourceNatEnabledNetworkOfferingProviders.get(service));
+ _ntwkOfferingServiceMapDao.persist(offService);
+ logger.trace("Added service {} for the network offering:
{}", service,
defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.getUniqueName());
}
// Offering #4
