added validation for CFD CSCwp64296#307
Conversation
|
pytest logs tests/checks/rogue_ep_coop_exception_mac_check/test_rogue_ep_coop_exception_mac_check.py::test_rogue_ep_coop_exception_mac_check[PASS_non_affected_tversion_affected_cversion_no_exception_MACs] ====================================================================== 13 passed in 0.20s ====================================================================== Pre-upgrade validation script logs:----------> !!!! Check https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script for Latest Release !!!! To use a non-default Login Domain, enter apic#DOMAIN\USERNAME Current APIC Version...6.1(5e) Target APIC version is overridden to 6.1(1f) Collecting VPC Node IDs... Progress: |----------------------------------------------------------------------------------------------------| 0/1 checks completed === Check Result (failed only) === === Summary Result === PASS : 1 |
|
Let's test the actual fail scenario using below method.
Example: bdsol-aci01-apic1# bdsol-aci01-apic1# root@0.0.0.0's password: bdsol-aci01-apic1# bdsol-aci01-apic1# bdsol-aci01-apic1# moquery -c presListener -f 'pres.Listener.dn*"exceptcont"' | grep dn | wc -l bdsol-aci01-apic1# moquery -c presListener -f 'pres.Listener.dn*"exceptcont"' | grep dn | wc -l |
|
rogue_ep_coop_exception_mac_check_Fail.txt |
…on-Script into psureshb
…ing_check" merged in master
…es for version compatibility
diwakarmishra1190
left a comment
diwakarmishra1190
left a comment
There was a problem hiding this comment.
New changes are working fine tested locally.
takishida
left a comment
takishida
left a comment
There was a problem hiding this comment.
I've updated the doc with the information that is relevant to users along with the new conditions.
Correct me if I'm wrong, but I doubt that the current condition checked by this rule will ever hit because I believe presListener will be missing on APICs after APICs are upgraded. But you are checking the current version being the older one and the target version being the affected one. That is only the case BEFORE APICs (or anything) are upgraded. In other words, the presListener issue has yet to happen.
Or if presLIsteners are created on APICs when switches are upgraded instead of APICs, using that as a condition doesn't make sense at all. This script is to prevent the issue from happening by detecting the conditions before the issue happens instead of checking the symptoms of the issue after hitting it.
Can you please review the updated doc and update the rule logic accordingly?
| # if cversion.newer_than("3.1(2v)") and tversion.older_than("6.1(3g)"): | ||
| if ( | ||
| (cversion.same_as("5.2(3e)") or cversion.newer_than("5.2(3e)")) and | ||
| (cversion.same_as("6.0(3g)") or cversion.older_than("6.0(3g)")) and |
There was a problem hiding this comment.
Why 6.0(3g)? The enhancement that caused CSCwp64296 was introduced in the first release of 6.0(3) which is 6.0(3d).
| ) | ||
| ): | ||
| # endpoint to fetch the rogue exception MACs | ||
| exception_mac_api = 'fvRogueExceptionMac.json?query-target-filter=and(wcard(fvRogueExceptionMac.dn,"([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}"))' |
There was a problem hiding this comment.
Why are you matching MAC address in regex here? fvRogueExceptionMac is for MAC as the name suggests. Its DN always has a MAC address.
Unless I'm missing something, this is just causing unnecessary query work on the APICs.
| exception_mac_api = 'fvRogueExceptionMac.json?query-target-filter=and(wcard(fvRogueExceptionMac.dn,"([0-9a-fA-F]{2}:){5}[0-9a-fA-F]{2}"))' | ||
|
|
||
| # endpoint to fetch the presListener entries | ||
| presListener_api = 'presListener.json?query-target-filter=and(wcard(presListener.dn,"exceptcont"))' |
There was a problem hiding this comment.
Instead of regex(wcard)), you should do exact match with lstDn such as eq(presListener.lstDn,"exceptcont")
And use rsp-subtree-include=count instead of having APICs return all of the contents because what we need to know is only the number of objects.
| exception_macs = icurl('class', exception_mac_api) | ||
|
|
||
| if exception_macs: | ||
| prints("Found {} exception MACs, checking presListener entries...".format(len(exception_macs))) |
There was a problem hiding this comment.
Do not use prints() inside a check function.
In the new framework with the progress bar, it will end up like this, breaking the progress bar view. Please use logging instead, if needed. Otherwise, those info should be stored in the data so that it can be displayed in the result table and JSON file.
--- skip ---
Collecting VPC Node IDs...
Found 1 exception MACs, checking presListener entries...-------------------------------------------------------| 0/1 checks completed <--- !!!!!
Progress: |████████████████████████████████████████████████████████████████████████████████████████████████████| 1/1 checks completed
=== Check Result (failed only) ===
|
|
||
| # Target version check | ||
| if not tversion: | ||
| prints("Target version not provided, skipping check.") |
There was a problem hiding this comment.
| prints("Target version not provided, skipping check.") |
3 participants
No description provided.