[PATCH pve-manager v3 31/45] network: apply the microseg policy on reload

[Hannes Laimer <h.laimer@proxmox.com>]

A network reload is the per-node step of an SDN apply, so the reload
applies the microseg policy of the running config after ifreload. A
failed ifreload or FRR step does not skip the apply, since a node with
one broken interface stanza would otherwise stay on its old policy. A
policy that cannot be applied fails the reload task.

Signed-off-by: Hannes Laimer <h.laimer@proxmox.com>
---
 PVE/API2/Network.pm | 31 ++++++++++++++++++++-----------
 1 file changed, 20 insertions(+), 11 deletions(-)

diff --git a/PVE/API2/Network.pm b/PVE/API2/Network.pm
index cc8aa8cacb19..316ef1a70a02 100644
--- a/PVE/API2/Network.pm
+++ b/PVE/API2/Network.pm
@@ -933,18 +933,27 @@ __PACKAGE__->register_method({
                     print "$2 : $line \n";
                 }
             };
-            PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);
-
-            if (defined($regenerate_frr)) {
-                # SDN (or a manual invocation) is requesting a
-                # specific behavior, so we abide by the parameter set.
-                PVE::Network::SDN::generate_frr_config(1) if $regenerate_frr;
-            } elsif (PVE::Network::SDN::running_config_has_frr()) {
-                # Reload is coming from the Web UI (or a manual
-                # invocation requesting no specific behavior), so we
-                # reload if there are FRR entities in the SDN config.
-                PVE::Network::SDN::generate_frr_config(1);
+            eval {
+                PVE::Tools::run_command(['ifreload', '-a'], errfunc => $err);
+
+                if (defined($regenerate_frr)) {
+                    # SDN (or a manual invocation) is requesting a
+                    # specific behavior, so we abide by the parameter set.
+                    PVE::Network::SDN::generate_frr_config(1) if $regenerate_frr;
+                } elsif (PVE::Network::SDN::running_config_has_frr()) {
+                    # Reload is coming from the Web UI (or a manual
+                    # invocation requesting no specific behavior), so we
+                    # reload if there are FRR entities in the SDN config.
+                    PVE::Network::SDN::generate_frr_config(1);
+                }
+            };
+            my $errors = $@;
+
+            if ($have_sdn) {
+                eval { PVE::Network::SDN::Microseg::apply_all() };
+                $errors .= $@;
             }
+            die $errors if $errors;
         };
         return $rpcenv->fork_worker('srvreload', 'networking', $authuser, $worker);
     },
-- 
2.47.3