API: Failed Object Creation due to Validation methods blocks Object Name

oxzi commented 2 weeks ago

Describe the bug

After a failed attempt to create some Object via the Icinga 2 API due to a validation exception, the chosen Object name is blocked and Icinga 2 aborts further attempts as they are re-creations. Please take a look at the To Reproduce section below, which should make it more obvious.

I stumbled about this issue while debugging changes for #10102, where I wanted to verify my Validate methods via the Icinga 2 API.

To Reproduce

To make sure that this has nothing to do with my code, my example uses TimePeriod and its validation method.

https://github.com/Icinga/icinga2/blob/e678f0977d54bd57cec5ab6d79d100410256c188/lib/icinga/timeperiod.cpp#L373

Try to create a TimePeriod Object named "oops" with invalid ranges values, resulting in TimePeriod::ValidateRanges to throw an exception. ``` $ curl -k -s -S -u root:icinga -H 'Accept: application/json' -X PUT 'https://localhost:5665/v1/objects/timeperiods/oops' -d '{"attrs": {"ranges": {"F": "F"}}, "pretty": true}' { "results": [ { "code": 500, "errors": [ "Error: Validation failed for object 'oops' of type 'TimePeriod'; Attribute 'ranges': Invalid time specification 'F': Invalid time specification: F\nLocation: in /var/lib/icinga2/api/packages/_api/8e2362bd-b6a8-415d-85fe-33074907fcd8/conf.d/timeperiods/oops.conf: 2:2-4:2" ], "status": "Object could not be created." } ] } ```
Verify no such "oops" Object exists. ``` $ curl -k -s -S -u root:icinga -H 'Accept: application/json' -X GET 'https://localhost:5665/v1/objects/timeperiods/oops' -d '{"pretty": true}' { "error": 404, "status": "No objects found." } ```
Retry to create a TimePeriod Object named "oops":
1. Retry by creating the same faulty TimePeriod: ``` $ curl -k -s -S -u root:icinga -H 'Accept: application/json' -X PUT 'https://localhost:5665/v1/objects/timeperiods/oops' -d '{"attrs": {"ranges": {"F": "F"}}, "pretty": true}' { "results": [ { "code": 500, "errors": [ "Error: Object 'oops' of type 'TimePeriod' re-defined: in /var/lib/icinga2/api/packages/_api/8e2362bd-b6a8-415d-85fe-33074907fcd8/conf.d/timeperiods/oops.conf: 1:0-1:23; previous definition: in /var/lib/icinga2/api/packages/_api/8e2362bd-b6a8-415d-85fe-33074907fcd8/conf.d/timeperiods/oops.conf: 1:0-1:23\nLocation: in /var/lib/icinga2/api/packages/_api/8e2362bd-b6a8-415d-85fe-33074907fcd8/conf.d/timeperiods/oops.conf: 1:0-1:23" ], "status": "Object could not be created." } ] } ```
2. Retry by creating a valid TimePeriod: ``` $ curl -k -s -S -u root:icinga -H 'Accept: application/json' -X PUT 'https://localhost:5665/v1/objects/timeperiods/oops' -d '{"attrs": {"ranges": {"2025-05-25": "00:00-24:00"}}, "pretty": true}' { "results": [ { "code": 500, "errors": [ "Error: Object 'oops' of type 'TimePeriod' re-defined: in /var/lib/icinga2/api/packages/_api/8e2362bd-b6a8-415d-85fe-33074907fcd8/conf.d/timeperiods/oops.conf: 1:0-1:23; previous definition: in /var/lib/icinga2/api/packages/_api/8e2362bd-b6a8-415d-85fe-33074907fcd8/conf.d/timeperiods/oops.conf: 1:0-1:23\nLocation: in /var/lib/icinga2/api/packages/_api/8e2362bd-b6a8-415d-85fe-33074907fcd8/conf.d/timeperiods/oops.conf: 1:0-1:23" ], "status": "Object could not be created." } ] } ```

On further inspection, the referenced file in the re-definition error does not exist. There is even no mention of such an object.

icinga@a1e262125edf:/$ cat /var/lib/icinga2/api/packages/_api/8e2362bd-b6a8-415d-85fe-33074907fcd8/conf.d/timeperiods/oops.conf
cat: /var/lib/icinga2/api/packages/_api/8e2362bd-b6a8-415d-85fe-33074907fcd8/conf.d/timeperiods/oops.conf: No such file or directory
icinga@a1e262125edf:/$ fgrep -ri oops /var/lib/icinga2; echo $?
1

Btw, I am also unable to delete it via the API:

$ curl -k -s -S -u root:icinga -H 'Accept: application/json' -X DELETE 'https://localhost:5665/v1/objects/timeperiods/oops' -d '{"pretty": true}'
{
    "error": 404,
    "status": "No objects found."
}

A specter is haunting Icinga 2 - the specter of TimePeriod.

Expected behavior

If Icinga 2 states that an "Object could not be created", one should be able to retry with the same name.

Screenshots

N/A

Your Environment

Include as many relevant details about the environment you experienced the problem in

Version used (icinga2 --version): #10102 which is a bit ahead of master
Operating System and version: NixOS "it's complicated"
Enabled features (icinga2 feature list): api checker icingadb ido-mysql ido-pgsql notification
Icinga Web 2 version and modules (System - About): N/A
Config validation (icinga2 daemon -C): :ballot_box_with_check:
If you run multiple Icinga 2 instances, the zones.conf file (or icinga2 object list --type Endpoint and icinga2 object list --type Zone) from all affected nodes.

Additional context

N/A

yhabteab commented 2 weeks ago

Version used (icinga2 --version): Icinga DB: Support Redis username authentication #10102 which is a bit ahead of master

GitHub says otherwise :-)!

See https://github.com/Icinga/icinga2/issues/10110!

oxzi commented 2 weeks ago

Damn. I tried searching for other issues, but failed to find any. Next time, I rebase first, but honestly, I haven't expected a fix in the meantime.

Edit: Verified that the bug was resolved after rebasing.

Icinga / icinga2