* [pve-devel] [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration
@ 2025-07-29 9:29 Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 1/5] sdn: add global lock for configuration Gabriel Goller
` (5 more replies)
0 siblings, 6 replies; 7+ messages in thread
From: Gabriel Goller @ 2025-07-29 9:29 UTC (permalink / raw)
To: pve-devel
## Introduction
This patch series lays the groundwork for the Proxmox Datacenter Manager
SDN/EVPN integration on the Proxmox VE side by introducing global locking for
the SDN configuration. It is intended to be used by the PDM implementation to
prevent concurrent changes to the SDN configuration, while the datacenter
manager is making configuration changes.
## How it works
This patch series adds three new API calls:
* POST /cluster/sdn/lock
* DELETE /cluster/sdn/lock
* POST /cluster/sdn/rollback
The SDN configuration can be locked by invoking the lock endpoint, which returns
a lock-token when the configuration has been locked successfully. This
lock-token needs to be used for subsequent API calls that perform configuration
changes. For this purpose, a new parameter has been added to all SDN API
endpoints that perform configuration changes. If the lock is currently set, then
API callers have to provide the lock-token in order for the API endpoints to
work. If there is no global lock set, then the endpoints work the same as
before.
The lock-token is stored in a new file in the pmxcfs: `/etc/pve/sdn/.lock`.
The lock can be released automatically on applying, where I added a flag that
governs whether the global lock should automatically be released on applying the
configuration. Otherwise the lock can always be removed by the release endpoint,
which has a force flag for forcibly releasing the lock without providing the
token.
In order to provide an escape hatch in the case of errors on the PDM side, I
added the functionality of rolling back to the current running configuration,
which has not been possible before. This endpoint throws away all pending
changes. This saves us from introducing a third layer of configuration files,
while also adding a new feature to the existing SDN stack, where one had to
tediously revert all changes one-by-one if one wanted to rollback to the running
configuration. We could consider doing this automatically in the future from
PDM, or at least expose it as opt-in behavior in the PDM settings.
For now, in case of failures, users have to manually unlock the SDN
configuration and then rollback using the following API endpoints:
pvesh delete /cluster/sdn/lock --force 1
pvesh create /cluster/sdn/rollback
If we want to introduce automatic rollback, implementing it this way saves us
from having to manually revert every single change we make. We lock the SDN
configuration only if there are no pending changes (the lock endpoint includes a
flag that governs this behavior), then proceed to make our changes. If we run
into any error we can be sure that only the changes we made to the SDN
configuration are pending, so this enables us to safely roll back the
configuration changes we made and unlock the SDN configuration.
## Changelog:
v2, thanks @Stefan and @Thomas:
* rename secret -> token
* use UUIDv7 instead of random string
v1, thanks @Stefan and @Thomas:
* rebase to trixie
* remove lock file from pmxcfs (just use file_get_contents, file_set_contents)
* change to a domain-lock like in the ha-stack
* implement rollback and locking for the fabrics
network:
Stefan Hanreich (5):
sdn: add global lock for configuration
api: add lock-token parameter to all api calls
api: add lock token parameter to apply endpoint
api: add lock and release endpoints for global configuration lock
api: add rollback endpoint
debian/control | 1 +
src/PVE/API2/Network/SDN.pm | 169 +++++++++++++++++-
src/PVE/API2/Network/SDN/Controllers.pm | 21 ++-
src/PVE/API2/Network/SDN/Dns.pm | 21 ++-
src/PVE/API2/Network/SDN/Fabrics/Fabric.pm | 8 +
.../API2/Network/SDN/Fabrics/FabricNode.pm | 9 +
src/PVE/API2/Network/SDN/Ipams.pm | 21 ++-
src/PVE/API2/Network/SDN/Subnets.pm | 22 ++-
src/PVE/API2/Network/SDN/Vnets.pm | 21 ++-
src/PVE/API2/Network/SDN/Zones.pm | 21 ++-
src/PVE/Network/SDN.pm | 86 ++++++++-
src/PVE/Network/SDN/Fabrics.pm | 2 +
12 files changed, 382 insertions(+), 20 deletions(-)
Summary over all repositories:
12 files changed, 382 insertions(+), 20 deletions(-)
--
Generated by git-murpp 0.8.0
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread
* [pve-devel] [PATCH network v3 1/5] sdn: add global lock for configuration
2025-07-29 9:29 [pve-devel] [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Gabriel Goller
@ 2025-07-29 9:29 ` Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 2/5] api: add lock-token parameter to all api calls Gabriel Goller
` (4 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Gabriel Goller @ 2025-07-29 9:29 UTC (permalink / raw)
To: pve-devel
From: Stefan Hanreich <s.hanreich@proxmox.com>
Add a new cluster-wide lock for SDN that prevents any changes to the
configuration if the generated lock-token is not provided. It works
by generating and storing a token in sdn/.lock which gets checked by
lock_sdn_config on every invocation. If the lock file exists, then the
lock token has to be supplied in order to make changes to the SDN
configuration.
Lock using the domain lock (`PVE::Cluster::cfs_lock_domain`) and "sdn"
string.
This is mainly a preparation for PDM, where PDM can take the lock and
prevent concurrent modifications to the SDN configuration from other
sources, even across multiple API calls.
Co-authored-by: Gabriel Goller <g.goller@proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
debian/control | 1 +
src/PVE/Network/SDN.pm | 54 ++++++++++++++++++++++++++++++++++++++----
2 files changed, 51 insertions(+), 4 deletions(-)
diff --git a/debian/control b/debian/control
index f64a2d4a90b1..b45d12621aab 100644
--- a/debian/control
+++ b/debian/control
@@ -26,6 +26,7 @@ Depends: libpve-common-perl (>= 9.0.2),
libnet-ip-perl,
libnetaddr-ip-perl,
libpve-rs-perl (>= 0.10.3),
+ libuuid-perl,
${misc:Depends},
${perl:Depends},
Recommends: frr-pythontools (>= 10.3.1-1+pve2~),
diff --git a/src/PVE/Network/SDN.pm b/src/PVE/Network/SDN.pm
index 0e7d1dfd239c..9f18f76417a5 100644
--- a/src/PVE/Network/SDN.pm
+++ b/src/PVE/Network/SDN.pm
@@ -8,12 +8,13 @@ use IO::Socket::SSL; # important for SSL_verify_callback
use JSON qw(decode_json from_json to_json);
use LWP::UserAgent;
use Net::SSLeay;
+use UUID;
use PVE::Cluster qw(cfs_read_file cfs_write_file cfs_lock_file);
use PVE::INotify;
use PVE::RESTEnvironment qw(log_warn);
use PVE::RPCEnvironment;
-use PVE::Tools qw(extract_param dir_glob_regex run_command);
+use PVE::Tools qw(file_get_contents file_set_contents extract_param dir_glob_regex run_command);
use PVE::Network::SDN::Vnets;
use PVE::Network::SDN::Zones;
@@ -48,6 +49,8 @@ my $write_running_cfg = sub {
PVE::Cluster::cfs_register_file($running_cfg, $parse_running_cfg, $write_running_cfg);
+my $LOCK_TOKEN_FILE = "/etc/pve/sdn/.lock";
+
# improve me : move status code inside plugins ?
sub ifquery_check {
@@ -197,14 +200,57 @@ sub commit_config {
cfs_write_file($running_cfg, $cfg);
}
+sub generate_lock_token {
+ my $str;
+ my $uuid;
+
+ UUID::generate_v7($uuid);
+ UUID::unparse($uuid, $str);
+
+ return $str;
+}
+
+sub create_global_lock {
+ my $token = generate_lock_token();
+ PVE::Tools::file_set_contents($LOCK_TOKEN_FILE, $token);
+ return $token;
+}
+
+sub delete_global_lock {
+ unlink $LOCK_TOKEN_FILE if -e $LOCK_TOKEN_FILE;
+}
+
sub lock_sdn_config {
- my ($code, $errmsg) = @_;
+ my ($code, $errmsg, $lock_token_user) = @_;
- cfs_lock_file($running_cfg, undef, $code);
+ my $lock_wrapper = sub {
+ my $lock_token = undef;
+ if (-e $LOCK_TOKEN_FILE) {
+ $lock_token = PVE::Tools::file_get_contents($LOCK_TOKEN_FILE);
+ }
+
+ if (
+ defined($lock_token)
+ && (!defined($lock_token_user) || $lock_token ne $lock_token_user)
+ ) {
+ die "invalid lock token provided!";
+ }
+
+ return $code->();
+ };
- if (my $err = $@) {
+ return lock_sdn_domain($lock_wrapper, $errmsg);
+}
+
+sub lock_sdn_domain {
+ my ($code, $errmsg) = @_;
+
+ my $res = PVE::Cluster::cfs_lock_domain("sdn", undef, $code);
+ my $err = $@;
+ if ($err) {
$errmsg ? die "$errmsg: $err" : die $err;
}
+ return $res;
}
sub get_local_vnets {
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread
* [pve-devel] [PATCH network v3 2/5] api: add lock-token parameter to all api calls
2025-07-29 9:29 [pve-devel] [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 1/5] sdn: add global lock for configuration Gabriel Goller
@ 2025-07-29 9:29 ` Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 3/5] api: add lock token parameter to apply endpoint Gabriel Goller
` (3 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Gabriel Goller @ 2025-07-29 9:29 UTC (permalink / raw)
To: pve-devel
From: Stefan Hanreich <s.hanreich@proxmox.com>
The parameter is optional, so all existing create/update/delete
invocations can work as before, only failing if the global lock is
currently set. This ensures backwards-compatibility with the existing
calls to the API in the frontend. If the lock is set, users will get
an error message when trying to modify the configuration from the web
UI.
Co-authored-by: Gabriel Goller <g.goller@proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
src/PVE/API2/Network/SDN/Controllers.pm | 21 ++++++++++++++++--
src/PVE/API2/Network/SDN/Dns.pm | 21 ++++++++++++++++--
src/PVE/API2/Network/SDN/Fabrics/Fabric.pm | 8 +++++++
.../API2/Network/SDN/Fabrics/FabricNode.pm | 9 ++++++++
src/PVE/API2/Network/SDN/Ipams.pm | 21 ++++++++++++++++--
src/PVE/API2/Network/SDN/Subnets.pm | 22 +++++++++++++++++--
src/PVE/API2/Network/SDN/Vnets.pm | 21 ++++++++++++++++--
src/PVE/API2/Network/SDN/Zones.pm | 21 ++++++++++++++++--
src/PVE/Network/SDN.pm | 9 ++++++++
src/PVE/Network/SDN/Fabrics.pm | 2 ++
10 files changed, 143 insertions(+), 12 deletions(-)
diff --git a/src/PVE/API2/Network/SDN/Controllers.pm b/src/PVE/API2/Network/SDN/Controllers.pm
index e6eb4cb39248..5c2b6c361dc7 100644
--- a/src/PVE/API2/Network/SDN/Controllers.pm
+++ b/src/PVE/API2/Network/SDN/Controllers.pm
@@ -168,13 +168,19 @@ __PACKAGE__->register_method({
permissions => {
check => ['perm', '/sdn/controllers', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Controllers::Plugin->createSchema(),
+ parameters => PVE::Network::SDN::Controllers::Plugin->createSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'controller');
+ my $lock_token = extract_param($param, 'lock-token');
my $plugin = PVE::Network::SDN::Controllers::Plugin->lookup($type);
my $opts = $plugin->check_config($id, $param, 1, 1);
@@ -204,6 +210,7 @@ __PACKAGE__->register_method({
},
"create sdn controller object failed",
+ $lock_token,
);
return undef;
@@ -219,7 +226,12 @@ __PACKAGE__->register_method({
permissions => {
check => ['perm', '/sdn/controllers', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Controllers::Plugin->updateSchema(),
+ parameters => PVE::Network::SDN::Controllers::Plugin->updateSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -227,6 +239,7 @@ __PACKAGE__->register_method({
my $id = extract_param($param, 'controller');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_token = extract_param($param, 'lock-token');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -257,6 +270,7 @@ __PACKAGE__->register_method({
},
"update sdn controller object failed",
+ $lock_token,
);
return undef;
@@ -281,6 +295,7 @@ __PACKAGE__->register_method({
completion => \&PVE::Network::SDN::Controllers::complete_sdn_controllers,
},
),
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
},
},
returns => { type => 'null' },
@@ -288,6 +303,7 @@ __PACKAGE__->register_method({
my ($param) = @_;
my $id = extract_param($param, 'controller');
+ my $lock_token = extract_param($param, 'lock-token');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -307,6 +323,7 @@ __PACKAGE__->register_method({
},
"delete sdn controller object failed",
+ $lock_token,
);
return undef;
diff --git a/src/PVE/API2/Network/SDN/Dns.pm b/src/PVE/API2/Network/SDN/Dns.pm
index c82e3544252f..48fc2f694bb2 100644
--- a/src/PVE/API2/Network/SDN/Dns.pm
+++ b/src/PVE/API2/Network/SDN/Dns.pm
@@ -123,13 +123,19 @@ __PACKAGE__->register_method({
permissions => {
check => ['perm', '/sdn/dns', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Dns::Plugin->createSchema(),
+ parameters => PVE::Network::SDN::Dns::Plugin->createSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'dns');
+ my $lock_token = extract_param($param, 'lock-token');
my $plugin = PVE::Network::SDN::Dns::Plugin->lookup($type);
my $opts = $plugin->check_config($id, $param, 1, 1);
@@ -157,6 +163,7 @@ __PACKAGE__->register_method({
},
"create sdn dns object failed",
+ $lock_token,
);
return undef;
@@ -172,7 +179,12 @@ __PACKAGE__->register_method({
permissions => {
check => ['perm', '/sdn/dns', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Dns::Plugin->updateSchema(),
+ parameters => PVE::Network::SDN::Dns::Plugin->updateSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -180,6 +192,7 @@ __PACKAGE__->register_method({
my $id = extract_param($param, 'dns');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_token = extract_param($param, 'lock-token');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -209,6 +222,7 @@ __PACKAGE__->register_method({
},
"update sdn dns object failed",
+ $lock_token,
);
return undef;
@@ -233,6 +247,7 @@ __PACKAGE__->register_method({
completion => \&PVE::Network::SDN::Dns::complete_sdn_dns,
},
),
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
},
},
returns => { type => 'null' },
@@ -240,6 +255,7 @@ __PACKAGE__->register_method({
my ($param) = @_;
my $id = extract_param($param, 'dns');
+ my $lock_token = extract_param($param, 'lock-token');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -255,6 +271,7 @@ __PACKAGE__->register_method({
},
"delete sdn dns object failed",
+ $lock_token,
);
return undef;
diff --git a/src/PVE/API2/Network/SDN/Fabrics/Fabric.pm b/src/PVE/API2/Network/SDN/Fabrics/Fabric.pm
index 8c47b1bc5f00..1201654dd401 100644
--- a/src/PVE/API2/Network/SDN/Fabrics/Fabric.pm
+++ b/src/PVE/API2/Network/SDN/Fabrics/Fabric.pm
@@ -138,6 +138,8 @@ __PACKAGE__->register_method({
code => sub {
my ($param) = @_;
+ my $lock_token = extract_param($param, 'lock-token');
+
PVE::Network::SDN::lock_sdn_config(
sub {
my $config = PVE::Network::SDN::Fabrics::config();
@@ -149,6 +151,7 @@ __PACKAGE__->register_method({
PVE::Network::SDN::Fabrics::write_config($config);
},
"adding fabric failed",
+ $lock_token,
);
},
});
@@ -170,6 +173,7 @@ __PACKAGE__->register_method({
},
code => sub {
my ($param) = @_;
+ my $lock_token = extract_param($param, 'lock-token');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -184,6 +188,7 @@ __PACKAGE__->register_method({
PVE::Network::SDN::Fabrics::write_config($config);
},
"updating fabric failed",
+ $lock_token,
);
},
});
@@ -208,6 +213,8 @@ __PACKAGE__->register_method({
code => sub {
my ($param) = @_;
+ my $lock_token = extract_param($param, 'lock-token');
+
PVE::Network::SDN::lock_sdn_config(
sub {
my $id = extract_param($param, 'id');
@@ -253,6 +260,7 @@ __PACKAGE__->register_method({
PVE::Network::SDN::Fabrics::write_config($config);
},
"deleting fabric failed",
+ $lock_token,
);
},
});
diff --git a/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm b/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm
index b28884434b37..000e4c39eb87 100644
--- a/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm
+++ b/src/PVE/API2/Network/SDN/Fabrics/FabricNode.pm
@@ -153,6 +153,8 @@ __PACKAGE__->register_method({
code => sub {
my ($param) = @_;
+ my $lock_token = extract_param($param, 'lock-token');
+
PVE::Network::SDN::lock_sdn_config(
sub {
my $config = PVE::Network::SDN::Fabrics::config();
@@ -164,6 +166,7 @@ __PACKAGE__->register_method({
PVE::Network::SDN::Fabrics::write_config($config);
},
"adding node failed",
+ $lock_token,
);
},
});
@@ -190,6 +193,8 @@ __PACKAGE__->register_method({
code => sub {
my ($param) = @_;
+ my $lock_token = extract_param($param, 'lock-token');
+
PVE::Network::SDN::lock_sdn_config(
sub {
my $fabric_id = extract_param($param, 'fabric_id');
@@ -204,6 +209,7 @@ __PACKAGE__->register_method({
PVE::Network::SDN::Fabrics::write_config($config);
},
"updating node failed",
+ $lock_token,
);
},
});
@@ -233,6 +239,8 @@ __PACKAGE__->register_method({
code => sub {
my ($param) = @_;
+ my $lock_token = extract_param($param, 'lock-token');
+
PVE::Network::SDN::lock_sdn_config(
sub {
my $fabric_id = extract_param($param, 'fabric_id');
@@ -247,6 +255,7 @@ __PACKAGE__->register_method({
PVE::Network::SDN::Fabrics::write_config($config);
},
"deleting node failed",
+ $lock_token,
);
},
});
diff --git a/src/PVE/API2/Network/SDN/Ipams.pm b/src/PVE/API2/Network/SDN/Ipams.pm
index e30d28ffec56..89e05eed3750 100644
--- a/src/PVE/API2/Network/SDN/Ipams.pm
+++ b/src/PVE/API2/Network/SDN/Ipams.pm
@@ -128,13 +128,19 @@ __PACKAGE__->register_method({
permissions => {
check => ['perm', '/sdn/ipams', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Ipams::Plugin->createSchema(),
+ parameters => PVE::Network::SDN::Ipams::Plugin->createSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'ipam');
+ my $lock_token = extract_param($param, 'lock-token');
my $plugin = PVE::Network::SDN::Ipams::Plugin->lookup($type);
my $opts = $plugin->check_config($id, $param, 1, 1);
@@ -164,6 +170,7 @@ __PACKAGE__->register_method({
},
"create sdn ipam object failed",
+ $lock_token,
);
return undef;
@@ -179,7 +186,12 @@ __PACKAGE__->register_method({
permissions => {
check => ['perm', '/sdn/ipams', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Ipams::Plugin->updateSchema(),
+ parameters => PVE::Network::SDN::Ipams::Plugin->updateSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -187,6 +199,7 @@ __PACKAGE__->register_method({
my $id = extract_param($param, 'ipam');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_token = extract_param($param, 'lock-token');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -216,6 +229,7 @@ __PACKAGE__->register_method({
},
"update sdn ipam object failed",
+ $lock_token,
);
return undef;
@@ -240,6 +254,7 @@ __PACKAGE__->register_method({
completion => \&PVE::Network::SDN::Ipams::complete_sdn_ipams,
},
),
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
},
},
returns => { type => 'null' },
@@ -247,6 +262,7 @@ __PACKAGE__->register_method({
my ($param) = @_;
my $id = extract_param($param, 'ipam');
+ my $lock_token = extract_param($param, 'lock-token');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -264,6 +280,7 @@ __PACKAGE__->register_method({
},
"delete sdn zone object failed",
+ $lock_token,
);
return undef;
diff --git a/src/PVE/API2/Network/SDN/Subnets.pm b/src/PVE/API2/Network/SDN/Subnets.pm
index c9f5452b1883..fc565323e808 100644
--- a/src/PVE/API2/Network/SDN/Subnets.pm
+++ b/src/PVE/API2/Network/SDN/Subnets.pm
@@ -190,13 +190,19 @@ __PACKAGE__->register_method({
description => "Require 'SDN.Allocate' permission on '/sdn/zones/<zone>/<vnet>'",
user => 'all',
},
- parameters => PVE::Network::SDN::SubnetPlugin->createSchema(),
+ parameters => PVE::Network::SDN::SubnetPlugin->createSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $cidr = extract_param($param, 'subnet');
+ my $lock_token = extract_param($param, 'lock-token');
my $vnet = $param->{vnet};
my $privs = ['SDN.Allocate'];
@@ -234,6 +240,7 @@ __PACKAGE__->register_method({
},
"create sdn subnet object failed",
+ $lock_token,
);
return undef;
@@ -250,7 +257,12 @@ __PACKAGE__->register_method({
description => "Require 'SDN.Allocate' permission on '/sdn/zones/<zone>/<vnet>'",
user => 'all',
},
- parameters => PVE::Network::SDN::SubnetPlugin->updateSchema(),
+ parameters => PVE::Network::SDN::SubnetPlugin->updateSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -258,6 +270,7 @@ __PACKAGE__->register_method({
my $id = extract_param($param, 'subnet');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_token = extract_param($param, 'lock-token');
my $vnet = $param->{vnet};
@@ -295,6 +308,7 @@ __PACKAGE__->register_method({
},
"update sdn subnet object failed",
+ $lock_token,
);
return undef;
@@ -321,6 +335,7 @@ __PACKAGE__->register_method({
completion => \&PVE::Network::SDN::Subnets::complete_sdn_subnets,
},
),
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
},
},
returns => { type => 'null' },
@@ -329,6 +344,8 @@ __PACKAGE__->register_method({
my $id = extract_param($param, 'subnet');
my $vnet = extract_param($param, 'vnet');
+ my $lock_token = extract_param($param, 'lock-token');
+
my $privs = ['SDN.Allocate'];
&$check_vnet_access($vnet, $privs);
@@ -354,6 +371,7 @@ __PACKAGE__->register_method({
},
"delete sdn subnet object failed",
+ $lock_token,
);
return undef;
diff --git a/src/PVE/API2/Network/SDN/Vnets.pm b/src/PVE/API2/Network/SDN/Vnets.pm
index 560828371beb..e6eb5d4cf9c6 100644
--- a/src/PVE/API2/Network/SDN/Vnets.pm
+++ b/src/PVE/API2/Network/SDN/Vnets.pm
@@ -205,13 +205,19 @@ __PACKAGE__->register_method({
permissions => {
check => ['perm', '/sdn/zones/{zone}', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::VnetPlugin->createSchema(),
+ parameters => PVE::Network::SDN::VnetPlugin->createSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'vnet');
+ my $lock_token = extract_param($param, 'lock-token');
PVE::Cluster::check_cfs_quorum();
mkdir("/etc/pve/sdn");
@@ -238,6 +244,7 @@ __PACKAGE__->register_method({
},
"create sdn vnet object failed",
+ $lock_token,
);
return undef;
@@ -254,7 +261,12 @@ __PACKAGE__->register_method({
description => "Require 'SDN.Allocate' permission on '/sdn/zones/<zone>/<vnet>'",
user => 'all',
},
- parameters => PVE::Network::SDN::VnetPlugin->updateSchema(),
+ parameters => PVE::Network::SDN::VnetPlugin->updateSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -262,6 +274,7 @@ __PACKAGE__->register_method({
my $id = extract_param($param, 'vnet');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_token = extract_param($param, 'lock-token');
my $privs = ['SDN.Allocate'];
&$check_vnet_access($id, $privs);
@@ -307,6 +320,7 @@ __PACKAGE__->register_method({
},
"update sdn vnet object failed",
+ $lock_token,
);
return undef;
@@ -332,6 +346,7 @@ __PACKAGE__->register_method({
completion => \&PVE::Network::SDN::Vnets::complete_sdn_vnets,
},
),
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
},
},
returns => { type => 'null' },
@@ -339,6 +354,7 @@ __PACKAGE__->register_method({
my ($param) = @_;
my $id = extract_param($param, 'vnet');
+ my $lock_token = extract_param($param, 'lock-token');
my $privs = ['SDN.Allocate'];
&$check_vnet_access($id, $privs);
@@ -356,6 +372,7 @@ __PACKAGE__->register_method({
},
"delete sdn vnet object failed",
+ $lock_token,
);
return undef;
diff --git a/src/PVE/API2/Network/SDN/Zones.pm b/src/PVE/API2/Network/SDN/Zones.pm
index e53e6e7d430d..0e4726bf79b2 100644
--- a/src/PVE/API2/Network/SDN/Zones.pm
+++ b/src/PVE/API2/Network/SDN/Zones.pm
@@ -207,13 +207,19 @@ __PACKAGE__->register_method({
permissions => {
check => ['perm', '/sdn/zones', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Zones::Plugin->createSchema(),
+ parameters => PVE::Network::SDN::Zones::Plugin->createSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
my $type = extract_param($param, 'type');
my $id = extract_param($param, 'zone');
+ my $lock_token = extract_param($param, 'lock-token');
my $plugin = PVE::Network::SDN::Zones::Plugin->lookup($type);
my $opts = $plugin->check_config($id, $param, 1, 1);
@@ -256,6 +262,7 @@ __PACKAGE__->register_method({
},
"create sdn zone object failed",
+ $lock_token,
);
return;
@@ -271,7 +278,12 @@ __PACKAGE__->register_method({
permissions => {
check => ['perm', '/sdn/zones/{zone}', ['SDN.Allocate']],
},
- parameters => PVE::Network::SDN::Zones::Plugin->updateSchema(),
+ parameters => PVE::Network::SDN::Zones::Plugin->updateSchema(
+ undef,
+ {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ },
+ ),
returns => { type => 'null' },
code => sub {
my ($param) = @_;
@@ -279,6 +291,7 @@ __PACKAGE__->register_method({
my $id = extract_param($param, 'zone');
my $digest = extract_param($param, 'digest');
my $delete = extract_param($param, 'delete');
+ my $lock_token = extract_param($param, 'lock-token');
if ($delete) {
$delete = [PVE::Tools::split_list($delete)];
@@ -344,6 +357,7 @@ __PACKAGE__->register_method({
},
"update sdn zone object failed",
+ $lock_token,
);
return;
@@ -368,6 +382,7 @@ __PACKAGE__->register_method({
completion => \&PVE::Network::SDN::Zones::complete_sdn_zones,
},
),
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
},
},
returns => { type => 'null' },
@@ -375,6 +390,7 @@ __PACKAGE__->register_method({
my ($param) = @_;
my $id = extract_param($param, 'zone');
+ my $lock_token = extract_param($param, 'lock-token');
PVE::Network::SDN::lock_sdn_config(
sub {
@@ -391,6 +407,7 @@ __PACKAGE__->register_method({
PVE::Network::SDN::Zones::write_config($cfg);
},
"delete sdn zone object failed",
+ $lock_token,
);
return;
diff --git a/src/PVE/Network/SDN.pm b/src/PVE/Network/SDN.pm
index 9f18f76417a5..8a963cb067c3 100644
--- a/src/PVE/Network/SDN.pm
+++ b/src/PVE/Network/SDN.pm
@@ -51,6 +51,15 @@ PVE::Cluster::cfs_register_file($running_cfg, $parse_running_cfg, $write_running
my $LOCK_TOKEN_FILE = "/etc/pve/sdn/.lock";
+PVE::JSONSchema::register_standard_option(
+ 'pve-sdn-lock-token',
+ {
+ type => 'string',
+ description => "the token for unlocking the global SDN configuration",
+ optional => 1,
+ },
+);
+
# improve me : move status code inside plugins ?
sub ifquery_check {
diff --git a/src/PVE/Network/SDN/Fabrics.pm b/src/PVE/Network/SDN/Fabrics.pm
index 796d14978cfe..d90992a7eceb 100644
--- a/src/PVE/Network/SDN/Fabrics.pm
+++ b/src/PVE/Network/SDN/Fabrics.pm
@@ -128,6 +128,7 @@ sub node_properties {
node_id => get_standard_option('pve-sdn-fabric-node-id'),
protocol => get_standard_option('pve-sdn-fabric-protocol'),
digest => get_standard_option('pve-config-digest'),
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
ip => {
type => 'string',
format => 'ipv4',
@@ -227,6 +228,7 @@ sub fabric_properties {
id => get_standard_option('pve-sdn-fabric-id'),
protocol => get_standard_option('pve-sdn-fabric-protocol'),
digest => get_standard_option('pve-config-digest'),
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
ip_prefix => {
type => 'string',
format => 'CIDR',
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread
* [pve-devel] [PATCH network v3 3/5] api: add lock token parameter to apply endpoint
2025-07-29 9:29 [pve-devel] [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 1/5] sdn: add global lock for configuration Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 2/5] api: add lock-token parameter to all api calls Gabriel Goller
@ 2025-07-29 9:29 ` Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 4/5] api: add lock and release endpoints for global configuration lock Gabriel Goller
` (2 subsequent siblings)
5 siblings, 0 replies; 7+ messages in thread
From: Gabriel Goller @ 2025-07-29 9:29 UTC (permalink / raw)
To: pve-devel
From: Stefan Hanreich <s.hanreich@proxmox.com>
Committing the configuration now requires a lock on the SDN
configuration, which was not required before. This is to prevent
concurrent callers from applying the SDN configuration, while the lock
is held. If there is no lock set, then this function behaves the same
as before.
Also add the functionality to automatically release the lock after
applying the configuration, for convenience reasons.
Co-authored-by: Gabriel Goller <g.goller@proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
src/PVE/API2/Network/SDN.pm | 32 ++++++++++++++++++++++++++++----
1 file changed, 28 insertions(+), 4 deletions(-)
diff --git a/src/PVE/API2/Network/SDN.pm b/src/PVE/API2/Network/SDN.pm
index 6645f28b5de1..924c9e4b31a2 100644
--- a/src/PVE/API2/Network/SDN.pm
+++ b/src/PVE/API2/Network/SDN.pm
@@ -9,7 +9,7 @@ use PVE::JSONSchema qw(get_standard_option);
use PVE::RESTHandler;
use PVE::RPCEnvironment;
use PVE::SafeSyslog;
-use PVE::Tools qw(run_command);
+use PVE::Tools qw(run_command extract_param);
use PVE::Network::SDN;
use PVE::API2::Network::SDN::Controllers;
@@ -126,6 +126,16 @@ __PACKAGE__->register_method({
},
parameters => {
additionalProperties => 0,
+ properties => {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ 'release-lock' => {
+ type => 'boolean',
+ optional => 1,
+ default => 1,
+ description =>
+ 'When lock-token has been provided and configuration successfully commited, release the lock automatically afterwards',
+ },
+ },
},
returns => {
type => 'string',
@@ -136,10 +146,24 @@ __PACKAGE__->register_method({
my $rpcenv = PVE::RPCEnvironment::get();
my $authuser = $rpcenv->get_user();
- my $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr();
- PVE::Network::SDN::commit_config();
+ my $lock_token = extract_param($param, 'lock-token');
+ my $release_lock = extract_param($param, 'release-lock');
+
+ my $previous_config_has_frr;
+ my $new_config_has_frr;
+
+ PVE::Network::SDN::lock_sdn_config(
+ sub {
+ $previous_config_has_frr = PVE::Network::SDN::running_config_has_frr();
+ PVE::Network::SDN::commit_config();
+ $new_config_has_frr = PVE::Network::SDN::running_config_has_frr();
+
+ PVE::Network::SDN::delete_global_lock() if $lock_token && $release_lock;
+ },
+ "could not commit SDN config",
+ $lock_token,
+ );
- my $new_config_has_frr = PVE::Network::SDN::running_config_has_frr();
my $skip_frr = !($previous_config_has_frr || $new_config_has_frr);
my $code = sub {
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread
* [pve-devel] [PATCH network v3 4/5] api: add lock and release endpoints for global configuration lock
2025-07-29 9:29 [pve-devel] [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Gabriel Goller
` (2 preceding siblings ...)
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 3/5] api: add lock token parameter to apply endpoint Gabriel Goller
@ 2025-07-29 9:29 ` Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 5/5] api: add rollback endpoint Gabriel Goller
2025-07-29 11:02 ` [pve-devel] applied-series: [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Thomas Lamprecht
5 siblings, 0 replies; 7+ messages in thread
From: Gabriel Goller @ 2025-07-29 9:29 UTC (permalink / raw)
To: pve-devel
From: Stefan Hanreich <s.hanreich@proxmox.com>
This endpoint exposes the newly introduced global lock functionality
via the API. It adds endpoints for acquiring and releasing the lock.
Acquiring the lock is as simple as:
pvesh create /cluster/sdn/lock
The flag 'allow-pending' governs whether the lock should be acquired
if there are pending configuration changes.
The release endpoint can also be used to forcibly release the lock via
CLI without requiring the knowledge of the lock-token:
pvesh delete /cluster/sdn/lock --force 1
Co-authored-by: Gabriel Goller <g.goller@proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
src/PVE/API2/Network/SDN.pm | 82 +++++++++++++++++++++++++++++++++++++
src/PVE/Network/SDN.pm | 23 +++++++++++
2 files changed, 105 insertions(+)
diff --git a/src/PVE/API2/Network/SDN.pm b/src/PVE/API2/Network/SDN.pm
index 924c9e4b31a2..9e59d0860dfc 100644
--- a/src/PVE/API2/Network/SDN.pm
+++ b/src/PVE/API2/Network/SDN.pm
@@ -116,6 +116,88 @@ my $create_reload_network_worker = sub {
};
__PACKAGE__->register_method({
+ name => 'lock',
+ protected => 1,
+ path => 'lock',
+ method => 'POST',
+ description => "Acquire global lock for SDN configuration",
+ permissions => {
+ check => ['perm', '/sdn', ['SDN.Allocate']],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ 'allow-pending' => {
+ type => 'boolean',
+ optional => 1,
+ default => 0,
+ description =>
+ 'if true, allow acquiring lock even though there are pending changes',
+ },
+ },
+ },
+ returns => {
+ type => 'string',
+ },
+ code => sub {
+ my ($param) = @_;
+
+ return PVE::Network::SDN::lock_sdn_config(
+ sub {
+ die "configuration has pending changes"
+ if !$param->{'allow-pending'} && PVE::Network::SDN::has_pending_changes();
+
+ return PVE::Network::SDN::create_global_lock();
+ },
+ "could not acquire lock for SDN config",
+ );
+ },
+});
+
+__PACKAGE__->register_method({
+ name => 'release_lock',
+ protected => 1,
+ path => 'lock',
+ method => 'DELETE',
+ description => "Release global lock for SDN configuration",
+ permissions => {
+ check => ['perm', '/sdn', ['SDN.Allocate']],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ 'force' => {
+ type => 'boolean',
+ optional => 1,
+ default => 0,
+ description => 'if true, allow releasing lock without providing the token',
+ },
+ },
+ },
+ returns => {
+ type => 'null',
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $code = sub {
+ PVE::Network::SDN::delete_global_lock();
+ };
+
+ if ($param->{force}) {
+ $code->();
+ } else {
+ PVE::Network::SDN::lock_sdn_config(
+ $code,
+ "could not release lock",
+ $param->{'lock-token'},
+ );
+ }
+ },
+});
+
+__PACKAGE__->register_method ({
name => 'reload',
protected => 1,
path => '',
diff --git a/src/PVE/Network/SDN.pm b/src/PVE/Network/SDN.pm
index 8a963cb067c3..83f2cc71845e 100644
--- a/src/PVE/Network/SDN.pm
+++ b/src/PVE/Network/SDN.pm
@@ -209,6 +209,29 @@ sub commit_config {
cfs_write_file($running_cfg, $cfg);
}
+sub has_pending_changes {
+ my $running_cfg = PVE::Network::SDN::running_config();
+
+ # only use configuration files which get written by commit_config here
+ my $config_files = {
+ zones => PVE::Network::SDN::Zones::config(),
+ vnets => PVE::Network::SDN::Vnets::config(),
+ subnets => PVE::Network::SDN::Subnets::config(),
+ controllers => PVE::Network::SDN::Controllers::config(),
+ };
+
+ for my $config_file (keys %$config_files) {
+ my $config = $config_files->{$config_file};
+ my $pending_config = PVE::Network::SDN::pending_config($running_cfg, $config, $config_file);
+
+ for my $id (keys %{ $pending_config->{ids} }) {
+ return 1 if $pending_config->{ids}->{$id}->{pending};
+ }
+ }
+
+ return 0;
+}
+
sub generate_lock_token {
my $str;
my $uuid;
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread
* [pve-devel] [PATCH network v3 5/5] api: add rollback endpoint
2025-07-29 9:29 [pve-devel] [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Gabriel Goller
` (3 preceding siblings ...)
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 4/5] api: add lock and release endpoints for global configuration lock Gabriel Goller
@ 2025-07-29 9:29 ` Gabriel Goller
2025-07-29 11:02 ` [pve-devel] applied-series: [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Thomas Lamprecht
5 siblings, 0 replies; 7+ messages in thread
From: Gabriel Goller @ 2025-07-29 9:29 UTC (permalink / raw)
To: pve-devel
From: Stefan Hanreich <s.hanreich@proxmox.com>
This adds the functionality of rolling back the pending configuration
to the currently running configuration, resetting all changes made
since last applying the SDN configuration. This is mainly thought as
an escape hatch for failed PDM transactions.
You can invoke the endpoint via CLI:
pvesh create /cluster/sdn/rollback [--lock-token X [--release-lock]]
If a lock is currently held on the configuration and you want to
forcibly rollback, you need to release the lock first via the
lock_release API endpoint.
Co-authored-by: Gabriel Goller <g.goller@proxmox.com>
Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
---
src/PVE/API2/Network/SDN.pm | 57 ++++++++++++++++++++++++++++++++++++-
1 file changed, 56 insertions(+), 1 deletion(-)
diff --git a/src/PVE/API2/Network/SDN.pm b/src/PVE/API2/Network/SDN.pm
index 9e59d0860dfc..7c919025933b 100644
--- a/src/PVE/API2/Network/SDN.pm
+++ b/src/PVE/API2/Network/SDN.pm
@@ -197,7 +197,62 @@ __PACKAGE__->register_method({
},
});
-__PACKAGE__->register_method ({
+__PACKAGE__->register_method({
+ name => 'rollback',
+ protected => 1,
+ path => 'rollback',
+ method => 'POST',
+ description => "Rollback pending changes to SDN configuration",
+ permissions => {
+ check => ['perm', '/sdn', ['SDN.Allocate']],
+ },
+ parameters => {
+ additionalProperties => 0,
+ properties => {
+ 'lock-token' => get_standard_option('pve-sdn-lock-token'),
+ 'release-lock' => {
+ type => 'boolean',
+ optional => 1,
+ default => 1,
+ description =>
+ 'When lock-token has been provided and configuration successfully rollbacked, release the lock automatically afterwards',
+ },
+ },
+ },
+ returns => {
+ type => 'null',
+ },
+ code => sub {
+ my ($param) = @_;
+
+ my $lock_token = extract_param($param, 'lock-token');
+ my $release_lock = extract_param($param, 'release-lock');
+
+ my $rollback = sub {
+ my $running_config = PVE::Network::SDN::running_config();
+
+ PVE::Network::SDN::Zones::write_config($running_config->{zones});
+ PVE::Network::SDN::Vnets::write_config($running_config->{vnets});
+ PVE::Network::SDN::Subnets::write_config($running_config->{subnets});
+ PVE::Network::SDN::Controllers::write_config($running_config->{controllers});
+
+ # if the config hasn't yet been applied after the introduction of
+ # fabrics then the key does not exist in the running config so we
+ # default to an empty hash
+ my $fabrics_config = $running_config->{fabrics}->{ids} // {};
+ my $parsed_fabrics_config = PVE::RS::SDN::Fabrics->running_config($fabrics_config);
+ PVE::Network::SDN::Fabrics::write_config($parsed_fabrics_config);
+
+ PVE::Network::SDN::delete_global_lock() if $lock_token && $release_lock;
+ };
+
+ PVE::Network::SDN::lock_sdn_config(
+ $rollback, "could not rollback SDN configuration", $lock_token,
+ );
+ },
+});
+
+__PACKAGE__->register_method({
name => 'reload',
protected => 1,
path => '',
--
2.39.5
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread
* [pve-devel] applied-series: [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration
2025-07-29 9:29 [pve-devel] [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Gabriel Goller
` (4 preceding siblings ...)
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 5/5] api: add rollback endpoint Gabriel Goller
@ 2025-07-29 11:02 ` Thomas Lamprecht
5 siblings, 0 replies; 7+ messages in thread
From: Thomas Lamprecht @ 2025-07-29 11:02 UTC (permalink / raw)
To: pve-devel, Gabriel Goller
On Tue, 29 Jul 2025 11:29:28 +0200, Gabriel Goller wrote:
> ## Introduction
>
> This patch series lays the groundwork for the Proxmox Datacenter Manager
> SDN/EVPN integration on the Proxmox VE side by introducing global locking for
> the SDN configuration. It is intended to be used by the PDM implementation to
> prevent concurrent changes to the SDN configuration, while the datacenter
> manager is making configuration changes.
>
> [...]
Applied, thanks! Folded in a fix to also mock the cfs_domain_lock method on
relevant test, as otherwise one would fail this test–and thus also the package
build–when executing them as unprivileged user.
[1/5] sdn: add global lock for configuration
commit: f7d4f22a42a506e6cd60f0de8fbac9f580b85c6f
[2/5] api: add lock-token parameter to all api calls
commit: f5966bbacd2998234795fb02f56bff24c7ecf7d6
[3/5] api: add lock token parameter to apply endpoint
commit: 6f1120693feb07f4ec6cd8c51c4b1d206a801ba5
[4/5] api: add lock and release endpoints for global configuration lock
commit: d6e50fb57ea7b4af47d7120d3066f19547bab81d
[5/5] api: add rollback endpoint
commit: ea6db24afdaf63dedcdd4d74ce97918f7f82b034
_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2025-07-29 11:02 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2025-07-29 9:29 [pve-devel] [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 1/5] sdn: add global lock for configuration Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 2/5] api: add lock-token parameter to all api calls Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 3/5] api: add lock token parameter to apply endpoint Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 4/5] api: add lock and release endpoints for global configuration lock Gabriel Goller
2025-07-29 9:29 ` [pve-devel] [PATCH network v3 5/5] api: add rollback endpoint Gabriel Goller
2025-07-29 11:02 ` [pve-devel] applied-series: [PATCH network v3 0/5] Add global locking and configuration rollback to SDN configuration Thomas Lamprecht
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox