added a pr to fix the overlay expansion job bug

Author: Riya

cns/restserver/internalapi.go

@@ -11,6 +11,7 @@ import (
 	"net"
 	"net/http"
 	"net/http/httptest"
+	"os"
 	"reflect"
 	"strconv"
 	"strings"
@@ -29,6 +30,7 @@ const (
 	// Known API names we care about
 	expectedIMDSAPIVersion = "2025-07-24"
 	PrefixOnNicNCVersion   = "1"
+	cnsStateFilePath       = "/var/lib/azure-network/azure-cns.json"
 )
 
 // This file contains the internal functions called by either HTTP APIs (api.go) or
@@ -636,7 +638,18 @@ func (service *HTTPRestService) CreateOrUpdateNetworkContainerInternal(req *cns.
 				existingReq.IPConfiguration.IPSubnet.PrefixLength,
 				req.IPConfiguration.IPSubnet.IPAddress,
 				req.IPConfiguration.IPSubnet.PrefixLength)
-			return types.PrimaryCANotSame
+			// delete the existing azure-cns file
+			if err := os.Remove(cnsStateFilePath); err != nil && !os.IsNotExist(err) {
+				logger.Errorf("[Azure CNS] Error deleting azure-cns state file: %v", err)
+			}
+
+			// panic (this will force azure-cns daemonset to restart and pick up the new state with updated nnc)
+			panic(fmt.Sprintf("PrimaryCA mismatch for NCId %s: old CA %s/%d, new CA %s/%d",
+				req.NetworkContainerid,
+				existingReq.IPConfiguration.IPSubnet.IPAddress,
+				existingReq.IPConfiguration.IPSubnet.PrefixLength,
+				req.IPConfiguration.IPSubnet.IPAddress,
+				req.IPConfiguration.IPSubnet.PrefixLength))
 		}
 	}
 

cns/restserver/internalapi_test.go

@@ -95,10 +95,22 @@ func TestReconcileNCStatePrimaryIPChangeShouldFail(t *testing.T) {
 		},
 	}
 
-	// now try to reconcile the state where the NC primary IP has changed
-	resp := svc.ReconcileIPAMStateForSwift(ncReqs, map[string]cns.PodInfo{}, &v1alpha.NodeNetworkConfig{})
+	// Create dummy CNS state file
+	stateFile := "/var/lib/azure-network/azure-cns.json"
+	_ = os.WriteFile(stateFile, []byte("dummy"), 0644)
+	defer os.Remove(stateFile)
+
+	defer func() {
+		if r := recover(); r == nil {
+			t.Errorf("Expected panic on PrimaryCA mismatch, but did not panic")
+		}
+		if _, err := os.Stat(stateFile); !os.IsNotExist(err) {
+			t.Errorf("Expected CNS state file to be deleted, but it still exists")
+		}
+	}()
 
-	assert.Equal(t, types.PrimaryCANotSame, resp)
+	// now try to reconcile the state where the NC primary IP has changed
+	_ = svc.ReconcileIPAMStateForSwift(ncReqs, map[string]cns.PodInfo{}, &v1alpha.NodeNetworkConfig{})
 }
 
 // TestReconcileNCStateGatewayChange tests that NC state gets updated when reconciled
@@ -1680,3 +1692,49 @@ func setupIMDSMockAPIsWithCustomIDs(svc *HTTPRestService, interfaceIDs []string)
 	// Return cleanup function
 	return func() { svc.imdsClient = originalIMDS }
 }
+
+func TestCreateOrUpdateNCInternal_PrimaryCAMismatchShouldPanicAndDeleteStateFile(t *testing.T) {
+	restartService()
+	setEnv(t)
+	setOrchestratorTypeInternal(cns.KubernetesCRD)
+
+	// Step 1: Create initial NC with PrimaryCA "10.0.0.5/24"
+	secondaryIPConfigs := make(map[string]cns.SecondaryIPConfig)
+	ipaddress := "10.0.0.6"
+	secIpConfig := newSecondaryIPConfig(ipaddress, -1)
+	ipId := uuid.New()
+	secondaryIPConfigs[ipId.String()] = secIpConfig
+
+	ncId := "test-nc"
+	ncVersion := "-1"
+	req := generateNetworkContainerRequest(secondaryIPConfigs, ncId, ncVersion)
+	req.IPConfiguration.IPSubnet.IPAddress = "10.0.0.5"
+	req.IPConfiguration.IPSubnet.PrefixLength = 24
+	returnCode := svc.CreateOrUpdateNetworkContainerInternal(req)
+	if returnCode != 0 {
+		t.Fatalf("Failed to createNetworkContainerRequest, req: %+v, err: %d", req, returnCode)
+	}
+	validateNetworkRequest(t, *req)
+
+	// Step 2: Prepare a request with a different PrimaryCA
+	reqMismatch := generateNetworkContainerRequest(secondaryIPConfigs, ncId, ncVersion)
+	reqMismatch.IPConfiguration.IPSubnet.IPAddress = "10.0.0.7" // different IP
+	reqMismatch.IPConfiguration.IPSubnet.PrefixLength = 24
+
+	// Step 3: Create dummy CNS state file
+	stateFile := "/var/lib/azure-network/azure-cns.json"
+	_ = os.WriteFile(stateFile, []byte("dummy"), 0644)
+	defer os.Remove(stateFile)
+
+	defer func() {
+		if r := recover(); r == nil {
+			t.Errorf("Expected panic on PrimaryCA mismatch, but did not panic")
+		}
+		if _, err := os.Stat(stateFile); !os.IsNotExist(err) {
+			t.Errorf("Expected CNS state file to be deleted, but it still exists")
+		}
+	}()
+
+	// Step 4: Should panic and delete state file
+	svc.CreateOrUpdateNetworkContainerInternal(reqMismatch)
+}