Add conserve mode for VPC offerings by nvazquez · Pull Request #12487 · apache/cloudstack

nvazquez · 2026-01-21T15:28:02Z

Description

This PR extends the conserve mode for VPCs tiers added on the previous PRs: #8309, #10744 by allowing:

If the VPC tier offering uses conserve mode, then the public IP used for Source NAT can be reused for multiple services (it was previously restricted to Source NAT only)

This PR also introduces the following changes:

Introduce conserve mode for VPC offerings
When a VPC is created from a VPC offering using conserve mode: public IP rules can be created on different VPC tiers (when conserve mode = false, the rules are restricted to a single VPC tier).

Fixes: #8317

Types of changes

Breaking change (fix or feature that would cause existing functionality to change)
New feature (non-breaking change which adds functionality)
Bug fix (non-breaking change which fixes an issue)
Enhancement (improves an existing feature and functionality)
Cleanup (Code refactoring and cleanup, that may add test cases)
Build/CI
Test (unit or integration test code)

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Major
Minor

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

Create a VPC Offering with Conserve mode enabled selecting:
- Conserve mode = True
- Services: Dns, Dhcp, Vpn, UserData, StaticNat, SourceNat, NetworkACL, Portforwarding, Lb as VpcVirtualRouter
Create VPC selecting the previous VPC Offering
Create VPC tiers with the default isolated network offering for VPC and deploy VMs on each tier
Observe the Source NAT IP address can be used for multiple services, create different rules
Acquire new Public IP address and create rules across different VPC tiers for the same Public IP address

How did you try to break this feature and the system with this change?

nvazquez · 2026-01-21T15:28:46Z

@blueorangutan package

blueorangutan · 2026-01-21T15:30:36Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

codecov · 2026-01-21T15:36:23Z

Codecov Report

❌ Patch coverage is 30.43478% with 48 lines in your changes missing coverage. Please review.
✅ Project coverage is 17.92%. Comparing base (1b0a036) to head (1367e43).
⚠️ Report is 180 commits behind head on main.

Files with missing lines	Patch %	Lines
...n/java/com/cloud/network/IpAddressManagerImpl.java	0.00%	8 Missing and 2 partials ⚠️
...e/cloudstack/api/response/VpcOfferingResponse.java	0.00%	6 Missing ⚠️
...main/java/com/cloud/network/vpc/VpcOfferingVO.java	0.00%	6 Missing ⚠️
...om/cloud/network/firewall/FirewallManagerImpl.java	76.00%	1 Missing and 5 partials ⚠️
...ck/api/command/admin/vpc/CreateVPCOfferingCmd.java	0.00%	3 Missing ⚠️
...rg/apache/cloudstack/api/response/VpcResponse.java	0.00%	3 Missing ⚠️
...java/com/cloud/api/query/vo/VpcOfferingJoinVO.java	0.00%	3 Missing ⚠️
...loud/network/lb/LoadBalancingRulesManagerImpl.java	0.00%	3 Missing ⚠️
...ain/java/com/cloud/network/vpc/VpcManagerImpl.java	40.00%	2 Missing and 1 partial ⚠️
...and/user/firewall/CreatePortForwardingRuleCmd.java	0.00%	1 Missing ⚠️
... and 4 more

Additional details and impacted files

@@             Coverage Diff              @@
##               main   #12487      +/-   ##
============================================
+ Coverage     17.84%   17.92%   +0.08%     
- Complexity    15980    16164     +184     
============================================
  Files          5929     5939      +10     
  Lines        531084   533262    +2178     
  Branches      64914    65252     +338     
============================================
+ Hits          94783    95610     +827     
- Misses       425686   426908    +1222     
- Partials      10615    10744     +129

Flag	Coverage Δ
uitests	`3.66% <ø> (+0.08%)`	⬆️
unittests	`19.04% <30.43%> (+0.09%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

blueorangutan · 2026-01-21T16:05:08Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✖️ debian ✖️ suse15. SL-JID 16471

nvazquez · 2026-01-21T18:58:21Z

@blueorangutan package

blueorangutan · 2026-01-21T19:00:35Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-01-21T19:40:01Z

Packaging result [SF]: ✖️ el8 ✖️ el9 ✔️ debian ✖️ suse15. SL-JID 16473

nvazquez · 2026-01-21T20:31:01Z

@blueorangutan package

blueorangutan · 2026-01-21T20:32:36Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-01-21T21:10:55Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✖️ debian ✔️ suse15. SL-JID 16475

nvazquez · 2026-01-21T21:12:43Z

@blueorangutan test keepEnv

blueorangutan · 2026-01-21T21:14:34Z

@nvazquez a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-01-22T13:29:06Z

[SF] Trillian test result (tid-15239)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 55566 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr12487-t15239-kvm-ol8.zip
Smoke tests completed. 147 look OK, 3 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_03_deploy_and_scale_kubernetes_cluster	`Failure`	26.70	test_kubernetes_clusters.py
test_02_list_cpvm_vm	`Failure`	0.03	test_ssvm.py
test_04_cpvm_internals	`Failure`	0.04	test_ssvm.py
test_01_redundant_vpc_site2site_vpn	`Failure`	392.36	test_vpc_vpn.py

nvazquez · 2026-01-27T05:13:52Z

@blueorangutan package

blueorangutan · 2026-01-27T05:16:05Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

nvazquez · 2026-02-24T22:41:39Z

@blueorangutan package

blueorangutan · 2026-02-24T22:42:04Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-24T23:33:25Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16930

nvazquez · 2026-02-24T23:46:29Z

@blueorangutan test

blueorangutan · 2026-02-24T23:48:03Z

@nvazquez a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

blueorangutan · 2026-02-25T00:29:12Z

[SF] Trillian Build Failed (tid-15519)

blueorangutan · 2026-02-25T01:04:47Z

[SF] Trillian Build Failed (tid-15520)

blueorangutan · 2026-02-25T15:56:16Z

[SF] Trillian test result (tid-15521)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 49215 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr12487-t15521-kvm-ol8.zip
Smoke tests completed. 146 look OK, 5 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_LoginApiDomain	`Error`	7.10	test_accounts.py
ContextSuite context=TestListIdsParams>:teardown	`Error`	1.12	test_list_ids_parameter.py
test_01_snapshot_root_disk	`Error`	4.96	test_snapshots.py
test_02_list_snapshots_with_removed_data_store	`Error`	46.63	test_snapshots.py
test_02_list_snapshots_with_removed_data_store	`Error`	46.63	test_snapshots.py
ContextSuite context=TestSnapshotStandaloneBackup>:teardown	`Error`	27.56	test_snapshots.py
test_01_snapshot_usage	`Error`	19.70	test_usage.py
test_01_vpn_usage	`Error`	1.11	test_usage.py
ContextSuite context=TestVPCConserveModeRules>:setup	`Error`	0.00	test_vpc_conserve_mode.py

nvazquez · 2026-02-25T18:07:20Z

@blueorangutan package

blueorangutan · 2026-02-25T18:08:05Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-25T19:18:12Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16948

nvazquez · 2026-02-25T19:18:57Z

@blueorangutan package

blueorangutan · 2026-02-25T19:20:04Z

@nvazquez a [SL] Jenkins job has been kicked to build packages. It will be bundled with no SystemVM templates. I'll keep you posted as I make progress.

blueorangutan · 2026-02-25T20:12:25Z

Packaging result [SF]: ✔️ el8 ✔️ el9 ✔️ el10 ✔️ debian ✔️ suse15. SL-JID 16950

nvazquez · 2026-02-25T20:43:47Z

@blueorangutan test

blueorangutan · 2026-02-25T20:46:04Z

@nvazquez a [SL] Trillian-Jenkins test job (ol8 mgmt + kvm-ol8) has been kicked to run smoke tests

api/src/main/java/org/apache/cloudstack/api/command/admin/vpc/CreateVPCOfferingCmd.java

weizhouapache · 2026-02-26T09:27:45Z

...c/main/java/org/apache/cloudstack/api/command/user/firewall/CreatePortForwardingRuleCmd.java

        Long ntwkId = null;

-        if (ip.getAssociatedWithNetworkId() != null) {
+        if (ip.getVpcId() == null && ip.getAssociatedWithNetworkId() != null) {


with this change, networkId becomes mandatory for vpcs , right ?

for existing vpc (created in older versions), will this cause an issue ? as the IP might be already associated to a network (vpc tier).

for example, in VPC

IP is associated to a VPC tier (in a old version), now create portwarding rule without networkId (currently it is not needed)

IP is associated to a VPC tier (in a old version), now create portwarding rule with another networkId (vpc tier). this is not supported in the past

@nvazquez
I asked this question as it might be possible that users might update the vpc by changing the conserve_mode of in the vpc_offerings table, or change the vpc_offering_id in the vpc table.
they are not normal use cases. currently no API to update offering of a vpc.

weizhouapache · 2026-02-26T09:36:00Z

...c/main/java/org/apache/cloudstack/api/command/user/firewall/CreatePortForwardingRuleCmd.java

-        if (ip.getAssociatedWithNetworkId() != null) {
+        if (ip.getVpcId() == null && ip.getAssociatedWithNetworkId() != null) {
            ntwkId = ip.getAssociatedWithNetworkId();
        } else {


Suggested change

} else {

} else if (ip.getAssociatedWithNetworkId() == null) {

ntwkId = networkId;

} else if (networkId == null) {

ntwkId = ip.getAssociatedWithNetworkId();

} else {

// TODO: check if ip.getAssociatedWithNetworkId() and networkId are the same ? is it needed ?

}

api/src/main/java/org/apache/cloudstack/api/response/VpcOfferingResponse.java

server/src/main/java/com/cloud/network/firewall/FirewallManagerImpl.java

weizhouapache · 2026-02-26T09:43:55Z

server/src/main/java/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java

            _accountMgr.checkAccess(caller.getCallingAccount(), null, true, ipAddr);

-            final Long networkId = ipAddr.getAssociatedWithNetworkId();
+            final Long networkId = ipAddr.getVpcId() == null ? ipAddr.getAssociatedWithNetworkId() : networkIdParam;


if the ip is associated with a vpc tier, should we allow a different networkId ?

test/integration/smoke/test_vpc_conserve_mode.py

weizhouapache · 2026-02-26T09:53:03Z

test/integration/smoke/test_vpc_conserve_mode.py

+            self.fail(
+                "Expected cross-tier Port Forwarding rule to succeed with "
+                "conserveMode=True, but got exception: %s" % e
+            )


try to add a lb rule too ?

weizhouapache · 2026-02-26T10:09:31Z

test/integration/smoke/test_vpc_conserve_mode.py

+
+    @attr(tags=["advanced", "advancedns", "smoke"], required_hardware="true")
+    def test_01_vpc_conserve_mode_cross_tier_rules_allowed(self):
+        """With conserveMode=True, LB rule on VPC Tier 1 and Port Forwarding rule on VPC Tier 2 can


any chance to update one of the existing smoke tests to test the same behaviour (which should expect an exception as the default vpc offering does not support conserve mode) ?

# ls test/integration/smoke/test_*vpc* test/integration/smoke/test_domain_vpc_offerings.py test/integration/smoke/test_vpc_redundant.py test/integration/smoke/test_vpc_vpn.py test/integration/smoke/test_vpc_ipv6.py test/integration/smoke/test_vpc_router_nics.py # test/integration/smoke/test_*acl* test/integration/smoke/test_global_acls.py test/integration/smoke/test_privategw_acl_ovs_gre.py test/integration/smoke/test_network_acl.py test/integration/smoke/test_privategw_acl.py

weizhouapache · 2026-02-26T10:13:46Z

@nvazquez
any doc PR linked ?

blueorangutan · 2026-02-26T12:49:11Z

[SF] Trillian test result (tid-15531)
Environment: kvm-ol8 (x2), zone: Advanced Networking with Mgmt server ol8
Total time taken: 54970 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr12487-t15531-kvm-ol8.zip
Smoke tests completed. 147 look OK, 4 have errors, 0 did not run
Only failed and skipped tests results shown below:

Test	Result	Time (s)	Test File
test_LoginApiDomain	`Error`	7.77	test_accounts.py
ContextSuite context=TestListIdsParams>:teardown	`Error`	1.17	test_list_ids_parameter.py
test_01_snapshot_root_disk	`Error`	6.04	test_snapshots.py
test_02_list_snapshots_with_removed_data_store	`Error`	49.85	test_snapshots.py
test_02_list_snapshots_with_removed_data_store	`Error`	49.85	test_snapshots.py
ContextSuite context=TestSnapshotStandaloneBackup>:teardown	`Error`	28.80	test_snapshots.py
test_01_snapshot_usage	`Error`	30.00	test_usage.py
test_01_vpn_usage	`Error`	1.09	test_usage.py

Fix conserve mode for VPC Source NAT and extend rules for VPC tiers

ca62353

boring-cyborg bot added component:api component:networking component:UI component:vpc labels Jan 21, 2026

Fix unit test

5ade2b3

Fixes

3fd969b

nvazquez marked this pull request as ready for review January 27, 2026 05:09

nvazquez requested review from DaanHoogland, Pearl1594, shwstppr, sureshanaparti and weizhouapache January 27, 2026 05:10

nvazquez added this to the 4.23.0 milestone Jan 27, 2026

nvazquez changed the title ~~Fix conserve mode for VPC Source NAT IP and extend rules for VPC tiers~~ Fix conserve mode for VPC Source NAT IP and extend conserve mode for VPC offerings Jan 27, 2026

nvazquez added 4 commits February 24, 2026 12:50

Fix VPC search on detectRulesConflict

3772560

Fix UI comments from Copilot review

980ccc9

Fix UI conditions preventing for missing parameter for conserve mode

a0755a1

Add unit tests for detectConflicts method and smoke tests

6d33ef1

boring-cyborg bot added component:integration-test component:marvin Python Warning... Python code Ahead! labels Feb 24, 2026

nvazquez marked this pull request as ready for review February 24, 2026 22:39

nvazquez removed the status:needs-work label Feb 24, 2026

Fix UI condition for PF rule creation

30e916d

Fix marvin tests

1367e43

weizhouapache reviewed Feb 26, 2026

View reviewed changes

-        } else {
+        } else if (ip.getAssociatedWithNetworkId() == null) {
+            ntwkId = networkId;
+        } else if (networkId == null) {
+            ntwkId = ip.getAssociatedWithNetworkId();
+        } else {
+            // TODO: check if ip.getAssociatedWithNetworkId() and networkId are the same ? is it needed ?
+        }

Conversation

nvazquez commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Types of changes

Feature/Enhancement Scale or Bug Severity

Feature/Enhancement Scale

Bug Severity

Screenshots (if appropriate):

How Has This Been Tested?

How did you try to break this feature and the system with this change?

Uh oh!

nvazquez commented Jan 21, 2026

Uh oh!

blueorangutan commented Jan 21, 2026

Uh oh!

codecov bot commented Jan 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

blueorangutan commented Jan 21, 2026

Uh oh!

nvazquez commented Jan 21, 2026

Uh oh!

blueorangutan commented Jan 21, 2026

Uh oh!

blueorangutan commented Jan 21, 2026

Uh oh!

nvazquez commented Jan 21, 2026

Uh oh!

blueorangutan commented Jan 21, 2026

Uh oh!

blueorangutan commented Jan 21, 2026

Uh oh!

nvazquez commented Jan 21, 2026

Uh oh!

blueorangutan commented Jan 21, 2026

Uh oh!

blueorangutan commented Jan 22, 2026

Uh oh!

nvazquez commented Jan 27, 2026

Uh oh!

blueorangutan commented Jan 27, 2026

Uh oh!

nvazquez commented Feb 24, 2026

Uh oh!

blueorangutan commented Feb 24, 2026

Uh oh!

blueorangutan commented Feb 24, 2026

Uh oh!

nvazquez commented Feb 24, 2026

Uh oh!

blueorangutan commented Feb 24, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

nvazquez commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

nvazquez commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

nvazquez commented Feb 25, 2026

Uh oh!

blueorangutan commented Feb 25, 2026

Uh oh!

Uh oh!

weizhouapache Feb 26, 2026

Choose a reason for hiding this comment

Uh oh!

nvazquez commented Jan 21, 2026 •

edited

Loading

codecov bot commented Jan 21, 2026 •

edited

Loading