advertised network isolation: use network ID as one of the ACL DB keys

Use network ID as one of the ACL DB keys to avoid any potential
conflicts for networks with the same name.

Signed-off-by: Patryk Diak <[email protected]>

Author: kyrtapz

go-controller/pkg/libovsdb/ops/db_object_types.go

@@ -161,6 +161,8 @@ var AddressSetAdvertisedNetwork = newObjectIDsType(addressSet, AdvertisedNetwork
 var ACLAdvertisedNetwork = newObjectIDsType(acl, AdvertisedNetworkOwnerType, []ExternalIDKey{
 	// ACL name
 	ObjectNameKey,
+	// NetworkID
+	NetworkKey,
 })
 
 var ACLAdminNetworkPolicy = newObjectIDsType(acl, AdminNetworkPolicyOwnerType, []ExternalIDKey{

go-controller/pkg/ovn/base_network_controller.go

@@ -1200,13 +1200,15 @@ func GetAdvertisedNetworkSubnetsDropACLdbIDs() *libovsdbops.DbObjectIDs {
 	return libovsdbops.NewDbObjectIDs(libovsdbops.ACLAdvertisedNetwork, advertisedNetworkIsolationACLID,
 		map[libovsdbops.ExternalIDKey]string{
 			libovsdbops.ObjectNameKey: advertisedNetworkSubnetsCtrl,
+			libovsdbops.NetworkKey:    "",
 		})
 }
 
-func GetAdvertisedNetworkSubnetsPassACLdbIDs(networkName string) *libovsdbops.DbObjectIDs {
+func GetAdvertisedNetworkSubnetsPassACLdbIDs(networkName string, networkID int) *libovsdbops.DbObjectIDs {
 	return libovsdbops.NewDbObjectIDs(libovsdbops.ACLAdvertisedNetwork, advertisedNetworkIsolationACLID,
 		map[libovsdbops.ExternalIDKey]string{
 			libovsdbops.ObjectNameKey: networkName,
+			libovsdbops.NetworkKey:    strconv.Itoa(networkID),
 		})
 }
 
@@ -1258,7 +1260,7 @@ func (bnc *BaseNetworkController) addAdvertisedNetworkIsolation(nodeName string)
 
 	if len(passMatches) > 0 {
 		passACL := libovsdbutil.BuildACL(
-			GetAdvertisedNetworkSubnetsPassACLdbIDs(bnc.GetNetworkName()),
+			GetAdvertisedNetworkSubnetsPassACLdbIDs(bnc.GetNetworkName(), bnc.GetNetworkID()),
 			types.AdvertisedNetworkPassPriority,
 			strings.Join(passMatches, " || "),
 			nbdb.ACLActionPass,
@@ -1268,7 +1270,7 @@ func (bnc *BaseNetworkController) addAdvertisedNetworkIsolation(nodeName string)
 
 		ops, err = libovsdbops.CreateOrUpdateACLsOps(bnc.nbClient, ops, nil, passACL)
 		if err != nil {
-			return fmt.Errorf("failed to create or update network isolation pass ACL %s for network %s: %w", GetAdvertisedNetworkSubnetsPassACLdbIDs(bnc.GetNetworkName()), bnc.GetNetworkName(), err)
+			return fmt.Errorf("failed to create or update network isolation pass ACL %s for network %s: %w", GetAdvertisedNetworkSubnetsPassACLdbIDs(bnc.GetNetworkName(), bnc.GetNetworkID()), bnc.GetNetworkName(), err)
 		}
 		ops, err = libovsdbops.AddACLsToLogicalSwitchOps(bnc.nbClient, ops, bnc.GetNetworkScopedSwitchName(nodeName), passACL)
 		if err != nil {
@@ -1307,7 +1309,7 @@ func (bnc *BaseNetworkController) deleteAdvertisedNetworkIsolation(nodeName stri
 		return err
 	}
 
-	passACLIDs := GetAdvertisedNetworkSubnetsPassACLdbIDs(bnc.GetNetworkName())
+	passACLIDs := GetAdvertisedNetworkSubnetsPassACLdbIDs(bnc.GetNetworkName(), bnc.GetNetworkID())
 	passACLPredicate := libovsdbops.GetPredicate[*nbdb.ACL](passACLIDs, nil)
 	passACLs, err := libovsdbops.FindACLsWithPredicate(bnc.nbClient, passACLPredicate)
 	if err != nil {

go-controller/pkg/ovn/gateway_test.go

@@ -33,7 +33,7 @@ func init() {
 	format.MaxLength = 0
 }
 
-func generateAdvertisedUDNIsolationExpectedNB(testData []libovsdbtest.TestData, networkName string, clusterIPSubnets []*net.IPNet, nodeSwitch *nbdb.LogicalSwitch, addrSet addressset.AddressSet) []libovsdbtest.TestData {
+func generateAdvertisedUDNIsolationExpectedNB(testData []libovsdbtest.TestData, networkName string, networkID int, clusterIPSubnets []*net.IPNet, nodeSwitch *nbdb.LogicalSwitch, addrSet addressset.AddressSet) []libovsdbtest.TestData {
 	var passMatches []string
 	for _, subnet := range clusterIPSubnets {
 		ipPrefix := "ip4"
@@ -44,7 +44,7 @@ func generateAdvertisedUDNIsolationExpectedNB(testData []libovsdbtest.TestData,
 
 	}
 	passACL := libovsdbutil.BuildACL(
-		GetAdvertisedNetworkSubnetsPassACLdbIDs(networkName),
+		GetAdvertisedNetworkSubnetsPassACLdbIDs(networkName, networkID),
 		types.AdvertisedNetworkPassPriority,
 		strings.Join(passMatches, " || "),
 		nbdb.ACLActionPass,

go-controller/pkg/ovn/master_test.go

@@ -1276,7 +1276,7 @@ var _ = ginkgo.Describe("Default network controller operations", func() {
 				if oc.isPodNetworkAdvertisedAtNode(node1.Name) {
 					addrSet, err := oc.addressSetFactory.GetAddressSet(GetAdvertisedNetworkSubnetsAddressSetDBIDs())
 					gomega.Expect(err).NotTo(gomega.HaveOccurred())
-					expectedNBDatabaseState = generateAdvertisedUDNIsolationExpectedNB(expectedNBDatabaseState, oc.GetNetworkName(), clusterSubnets, expectedNodeSwitch, addrSet)
+					expectedNBDatabaseState = generateAdvertisedUDNIsolationExpectedNB(expectedNBDatabaseState, oc.GetNetworkName(), oc.GetNetworkID(), clusterSubnets, expectedNodeSwitch, addrSet)
 				}
 				GR = nil
 				for _, testObj := range expectedNBDatabaseState {