F5Networks / f5-declarative-onboarding

F5 BIG-IP Declarative Onboarding
Apache License 2.0
58 stars 22 forks source link

DO failing attempting to remove a tunnel that was auto created by an APM connectivity profile #350

Open lynxx131 opened 1 year ago

lynxx131 commented 1 year ago

Environment

Summary

We are using an APM VPN connectivity profile however since upgrading from DO 1.27 to 1.36 the declaration now fails as it is trying to delete the tunnel that is auto created by the APM connectivity profile.

Steps To Reproduce

Steps to reproduce the behavior:

  1. Successfully send an initial declaration, any declaration will work as long as it enables the APM module.

  2. Create an APM connectivity profile, we used the iControl REST API to create ours from Terraform as there doesn't seem to be a way to create an APM connectivity profile from either DO or AS3.

Payload POST'ed to /mgmt/tm/apm/profile/connectivity to create profile

{
   "name": "pa_connectivity",
   "defaultsFrom": "/Common/connectivity",
   "description": "PA default APM connectivity profile"
}
  1. Check in the GUI that a tunnel named pa_connectivity (or whatever you call the profile) has been created under Network -> Tunnels.

  2. Re-run the same declaration as in step 1

Expected Behavior

Declaration POST succeeds

Actual Behavior

Declaration fails as DO is trying to delete the tunnel while it is in use by an APM profile.

{
    "id": "8d4053e9-4c1a-4774-a227-9addfc5bf02a",
    "selfLink": "https://localhost/mgmt/shared/declarative-onboarding/task/8d4053e9-4c1a-4774-a227-9addfc5bf02a",
    "code": 422,
    "status": "ERROR",
    "message": "invalid config - rolled back",
    "errors": [
        "01070265:3: The tunnel (/Common/pa_connectivity) cannot be deleted because it is in use by a profile (/Common/pa_connectivity).",
        "01070265:3: The tunnel (/Common/pa_connectivity) cannot be deleted because it is in use by a profile (/Common/pa_connectivity)."
    ],
    "result": {
        "class": "Result",
        "code": 422,
        "status": "ERROR",
        "dryRun": false,
        "message": "invalid config - rolled back",
        "errors": [
            "01070265:3: The tunnel (/Common/pa_connectivity) cannot be deleted because it is in use by a profile (/Common/pa_connectivity).",
            "01070265:3: The tunnel (/Common/pa_connectivity) cannot be deleted because it is in use by a profile (/Common/pa_connectivity)."
        ]
    },
}