F5Networks / f5-appsvcs-extension

F5 BIG-IP Application Services 3 Extension
Apache License 2.0
163 stars 52 forks source link

Services address is removed from /Common/Shared when deleting app in tenant #848

Open Tobse95 opened 5 days ago

Tobse95 commented 5 days ago

Environment

Summary

Our config within a tenant/application references a service address (0.0.0.0) address in Common Shared (name: /Common/Shared/x_service-address_any). If you delete this application within a tenant, the service address in the common partition will also be deleted. This must not happen and disrupts our further process.

We use per app declaration

Steps To Reproduce

Steps to reproduce the behavior:

  1. Submit the following two declarations: /Common/Shared

    "action": "deploy",
    "class": "AS3",
    "declaration": {
        "class": "ADC",
        "schemaVersion": "3.45.0",
        "Common": {
            "class": "Tenant",
            "Shared": {
                "x_service-address_any": {
                    "class": "Service_Address",
                    "virtualAddress": "0.0.0.0",
                    "icmpEcho": "disable",
                    "arpEnabled": false
                },
    }
    }
    [adc-tenant](https://xxx/mgmt/shared/appsvcs/declare/adc-tenant/applications/)
    {
    "app_10.11.238.0_24": {
    "class": "Application",
    "label": "10.11.238.0/24",
    "remark": "applicationx for 10.11.238.0/24",
    "sf-ext_10.11.238.0_24": {
      "allowVlans": [
        {
          "bigip": "/adc-tenant/dmz_123"
        }
      ],
      "class": "Service_Forwarding",
      "forwardingType": "ip",
      "label": "10.11.238.0/24",
      "policyFirewallEnforced": {
        "use": "x_firewall-policy_10.11.238.0_24"
      },
    
      "remark": "service forwrding ext for 10.11.238.0/24",
      "shareAddresses": true,
      "snat": "none",
      "translateServerAddress": false,
      "translateServerPort": false,
      "virtualAddresses": [
        [
          {
            "use": "/Common/Shared/x_service-address_any"
          },
          "10.11.238.0/24"
        ]
      ],
      "virtualPort": 0
    },
    "sf-int_10.11.238.0_24": {
      "class": "Service_Forwarding",
      "forwardingType": "ip",
      "label": "10.11.238.0/24",
      "policyFirewallEnforced": {
        "use": "x_firewall-policy_10.11.238.0_24"
      },
      "profileL4": {
        "use": "/Common/Shared/x_default_profiles_protocol_l4"
      },
      "rejectVlans": [
        {
          "bigip": "/adc-tenant/dmz_123"
        },
        {
          "bigip": "/Common/http-tunnel"
        },
        {
          "bigip": "/Common/socks-tunnel"
        }
      ],
      "remark": "service forwrding dint for 10.11.238.0/24",
      "securityLogProfiles": [
        {
          "use": "/Common/Shared/x_default_profiles_security_log"
        }
      ],
      "shareAddresses": true,
      "snat": "none",
      "translateServerAddress": false,
      "translateServerPort": false,
      "virtualAddresses": [
        {
          "use": "/Common/Shared/x_service-address_any"
        }
      ],
      "virtualPort": 0
    },
    "x_firewall-policy_10.11.238.0_24": {
      "class": "Firewall_Policy",
      "label": "10.11.238.0/24",
      "remark": "firewall policy for 10.11.238.0/24",
      "rules": [
        {
          "use": "/Common/Shared/x_firewall-rule-list_global"
        },
        {
          "use": "x_firewall-rule-list_10.11.238.0_24_product-related"
        },
        {
          "use": "x_firewall-rule-list_10.11.238.0_24_architecture-related"
        },
        {
          "use": "/Common/Shared/x_firewall-rule-list_drop"
        }
      ]
    },
    "x_firewall-rule-list_10.11.238.0_24_application-related": {
      "class": "Firewall_Rule_List",
      "label": "10.11.238.0/24",
      "remark": "firewall rule list aspplissssscation related for 10.11.238.0/24",
      "rules": []
    },
    "x_firewall-rule-list_10.11.238.0_24_architecture-related": {
      "class": "Firewall_Rule_List",
      "label": "10.11.238.0/24",
      "remark": "firewall rule slist architecture related for 10.11.238.0/24",
      "rules": []
    },
    "x_firewall-rule-list_10.11.238.0_24_product-related": {
      "class": "Firewall_Rule_List",
      "label": "10.11.238.0/24",
      "remark": "firewall rule lsisst product related for 10.11.238.0/24",
      "rules": []
    }
    },
    "controls": {
    "class": "Controls",
    "logLevel": "debug",
    "trace": true
    },
    "id": "per-app-declaration",
    "schemaVersion": "3.51.0"
    }

    Delete with

https://xxxx/mgmt/shared/appsvcs/declare/adc-tenant/applications/app_10.11.238.0_24

  1. Observe the following error response:
    {
    "results": [
        {
            "code": 422,
            "message": "declaration failed",
            "response": "0107082a:3: All objects must be removed from a partition (adc-tenant) before the partition may be removed, type ID (18797)",
            "host": "localhost",
            "tenant": "adc-tenant",
            "runTime": 5720,
            "declarationId": "1719494046084"
        }
    ],

Expected Behavior

1) Correct response in the result because the app was successfully deleted 2) x_service-address_any should not be removed from the bigip in /Common/Shared

Actual Behavior

After the reproduction of the steps you will see, that the service any address is removed from /common/shared in the bigip gui.