Skip to content

Soft delete port forwarding, load balancing and firewall rules #13015

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
bernardodemarco wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Soft delete port forwarding, load balancing and firewall rules #13015

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
29e86a4
Soft delete PF, LB and FW rules
bernardodemarco Apr 13, 2026
a2536a4
add missing column
bernardodemarco May 19, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions engine/schema/src/main/java/com/cloud/network/LBHealthCheckPolicyVO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,7 @@
// under the License.
package com.cloud.network;

import java.util.Date;
import java.util.UUID;

import javax.persistence.Column;
Expand All @@ -25,8 +26,11 @@
import javax.persistence.Id;
import javax.persistence.PrimaryKeyJoinColumn;
import javax.persistence.Table;
import javax.persistence.Temporal;
import javax.persistence.TemporalType;

import com.cloud.network.rules.HealthCheckPolicy;
import com.cloud.utils.db.GenericDao;
import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;

@Entity
Expand Down Expand Up @@ -68,6 +72,10 @@ public class LBHealthCheckPolicyVO implements HealthCheckPolicy {
@Column(name = "display", updatable = true, nullable = false)
protected boolean display = true;

@Column(name = GenericDao.REMOVED_COLUMN)
@Temporal(value = TemporalType.TIMESTAMP)
private Date removed;

protected LBHealthCheckPolicyVO() {
this.uuid = UUID.randomUUID().toString();
}
Expand Down
1 change: 1 addition & 0 deletions engine/schema/src/main/java/com/cloud/network/dao/FirewallRulesDaoImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -94,6 +94,7 @@ protected FirewallRulesDaoImpl() {
ReleaseSearch.and("ipId", ReleaseSearch.entity().getSourceIpAddressId(), Op.EQ);
ReleaseSearch.and("purpose", ReleaseSearch.entity().getPurpose(), Op.EQ);
ReleaseSearch.and("ports", ReleaseSearch.entity().getSourcePortStart(), Op.IN);
ReleaseSearch.and("removed", ReleaseSearch.entity().getRemoved(), Op.NULL);
ReleaseSearch.done();

SystemRuleSearch = createSearchBuilder();
Expand Down
6 changes: 4 additions & 2 deletions engine/schema/src/main/java/com/cloud/network/dao/LBHealthCheckPolicyDaoImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,17 +32,19 @@ public class LBHealthCheckPolicyDaoImpl extends GenericDaoBase<LBHealthCheckPoli
public void remove(long loadBalancerId) {
SearchCriteria<LBHealthCheckPolicyVO> sc = createSearchCriteria();
sc.addAnd("loadBalancerId", SearchCriteria.Op.EQ, loadBalancerId);
sc.addAnd("removed", SearchCriteria.Op.NULL);

expunge(sc);
remove(sc);
}

@Override
public void remove(long loadBalancerId, Boolean revoke) {
SearchCriteria<LBHealthCheckPolicyVO> sc = createSearchCriteria();
sc.addAnd("loadBalancerId", SearchCriteria.Op.EQ, loadBalancerId);
sc.addAnd("revoke", SearchCriteria.Op.EQ, revoke);
sc.addAnd("removed", SearchCriteria.Op.NULL);

expunge(sc);
remove(sc);
}

@Override
Expand Down
2 changes: 2 additions & 0 deletions engine/schema/src/main/java/com/cloud/network/dao/LBStickinessPolicyDao.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,4 +28,6 @@ public interface LBStickinessPolicyDao extends GenericDao<LBStickinessPolicyVO,
List<LBStickinessPolicyVO> listByLoadBalancerIdAndDisplayFlag(long loadBalancerId, boolean forDisplay);

List<LBStickinessPolicyVO> listByLoadBalancerId(long loadBalancerId, boolean revoke);

List<LBStickinessPolicyVO> listByLoadBalancerId(long loadBalancerId);
}
12 changes: 10 additions & 2 deletions engine/schema/src/main/java/com/cloud/network/dao/LBStickinessPolicyDaoImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,17 +31,19 @@ public class LBStickinessPolicyDaoImpl extends GenericDaoBase<LBStickinessPolicy
public void remove(long loadBalancerId) {
SearchCriteria<LBStickinessPolicyVO> sc = createSearchCriteria();
sc.addAnd("loadBalancerId", SearchCriteria.Op.EQ, loadBalancerId);
sc.addAnd("removed", SearchCriteria.Op.NULL);

expunge(sc);
remove(sc);
}

@Override
public void remove(long loadBalancerId, Boolean revoke) {
SearchCriteria<LBStickinessPolicyVO> sc = createSearchCriteria();
sc.addAnd("loadBalancerId", SearchCriteria.Op.EQ, loadBalancerId);
sc.addAnd("revoke", SearchCriteria.Op.EQ, revoke);
sc.addAnd("removed", SearchCriteria.Op.NULL);

expunge(sc);
remove(sc);
}

@Override
Expand All @@ -62,4 +64,10 @@ public List<LBStickinessPolicyVO> listByLoadBalancerId(long loadBalancerId, bool
return listBy(sc);
}

@Override
public List<LBStickinessPolicyVO> listByLoadBalancerId(long loadBalancerId) {
SearchCriteria<LBStickinessPolicyVO> sc = createSearchCriteria();
sc.addAnd("loadBalancerId", SearchCriteria.Op.EQ, loadBalancerId);
return listBy(sc);
}
}
8 changes: 8 additions & 0 deletions engine/schema/src/main/java/com/cloud/network/dao/LBStickinessPolicyVO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@
package com.cloud.network.dao;

import java.util.ArrayList;
import java.util.Date;
import java.util.HashMap;
import java.util.Iterator;
import java.util.List;
Expand All @@ -30,9 +31,12 @@
import javax.persistence.Id;
import javax.persistence.PrimaryKeyJoinColumn;
import javax.persistence.Table;
import javax.persistence.Temporal;
import javax.persistence.TemporalType;

import com.cloud.network.rules.StickinessPolicy;
import com.cloud.utils.Pair;
import com.cloud.utils.db.GenericDao;
import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;

@Entity
Expand Down Expand Up @@ -68,6 +72,10 @@ public class LBStickinessPolicyVO implements StickinessPolicy {
@Column(name = "display", updatable = true, nullable = false)
protected boolean display = true;

@Column(name = GenericDao.REMOVED_COLUMN)
@Temporal(value = TemporalType.TIMESTAMP)
private Date removed;

protected LBStickinessPolicyVO() {
this.uuid = UUID.randomUUID().toString();
}
Expand Down
8 changes: 8 additions & 0 deletions engine/schema/src/main/java/com/cloud/network/dao/LoadBalancerCertMapVO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,13 +16,17 @@
// under the License.
package com.cloud.network.dao;

import java.util.Date;
import java.util.UUID;

import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.Id;
import javax.persistence.Table;
import javax.persistence.Temporal;
import javax.persistence.TemporalType;

import com.cloud.utils.db.GenericDao;
import org.apache.cloudstack.api.InternalIdentity;

@Entity
Expand All @@ -45,6 +49,10 @@ public class LoadBalancerCertMapVO implements InternalIdentity {
@Column(name = "revoke")
private boolean revoke = false;

@Column(name = GenericDao.REMOVED_COLUMN)
@Temporal(value = TemporalType.TIMESTAMP)
private Date removed;

public LoadBalancerCertMapVO() {
this.uuid = UUID.randomUUID().toString();
}
Expand Down
9 changes: 6 additions & 3 deletions engine/schema/src/main/java/com/cloud/network/dao/LoadBalancerVMMapDaoImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,20 +34,22 @@ public class LoadBalancerVMMapDaoImpl extends GenericDaoBase<LoadBalancerVMMapVO
public void remove(long loadBalancerId) {
SearchCriteria<LoadBalancerVMMapVO> sc = createSearchCriteria();
sc.addAnd("loadBalancerId", SearchCriteria.Op.EQ, loadBalancerId);
sc.addAnd("removed", SearchCriteria.Op.NULL);

expunge(sc);
remove(sc);
}

@Override
public void remove(long loadBalancerId, List<Long> instanceIds, Boolean revoke) {
SearchCriteria<LoadBalancerVMMapVO> sc = createSearchCriteria();
sc.addAnd("loadBalancerId", SearchCriteria.Op.EQ, loadBalancerId);
sc.addAnd("instanceId", SearchCriteria.Op.IN, instanceIds.toArray());
sc.addAnd("removed", SearchCriteria.Op.NULL);
if (revoke != null) {
sc.addAnd("revoke", SearchCriteria.Op.EQ, revoke);
}

expunge(sc);
remove(sc);
}

@Override
Expand All @@ -56,12 +58,13 @@ public void remove(long loadBalancerId, long instanceId, String instanceIp, Bool
sc.addAnd("loadBalancerId", SearchCriteria.Op.EQ, loadBalancerId);
sc.addAnd("instanceId", SearchCriteria.Op.IN, instanceId);
sc.addAnd("instanceIp", SearchCriteria.Op.EQ, instanceIp);
sc.addAnd("removed", SearchCriteria.Op.NULL);

if (revoke != null) {
sc.addAnd("revoke", SearchCriteria.Op.EQ, revoke);
}

expunge(sc);
remove(sc);
}


Expand Down
9 changes: 9 additions & 0 deletions engine/schema/src/main/java/com/cloud/network/dao/LoadBalancerVMMapVO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,9 +22,14 @@
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.Table;
import javax.persistence.Temporal;
import javax.persistence.TemporalType;

import com.cloud.utils.db.GenericDao;
import org.apache.cloudstack.api.InternalIdentity;

import java.util.Date;

@Entity
@Table(name = "load_balancer_vm_map")
public class LoadBalancerVMMapVO implements InternalIdentity {
Expand All @@ -48,6 +53,10 @@ public class LoadBalancerVMMapVO implements InternalIdentity {
@Column(name = "state")
private String state;

@Column(name = GenericDao.REMOVED_COLUMN)
@Temporal(value = TemporalType.TIMESTAMP)
private Date removed = null;

public LoadBalancerVMMapVO() {
}

Expand Down
10 changes: 10 additions & 0 deletions engine/schema/src/main/java/com/cloud/network/rules/FirewallRuleVO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -32,6 +32,8 @@
import javax.persistence.Inheritance;
import javax.persistence.InheritanceType;
import javax.persistence.Table;
import javax.persistence.Temporal;
import javax.persistence.TemporalType;
import javax.persistence.Transient;

import com.cloud.utils.db.GenericDao;
Expand Down Expand Up @@ -82,6 +84,10 @@ public class FirewallRuleVO implements FirewallRule {
@Column(name = GenericDao.CREATED_COLUMN)
Date created;

@Column(name = GenericDao.REMOVED_COLUMN)
@Temporal(value = TemporalType.TIMESTAMP)
private Date removed;

@Column(name = "network_id")
Long networkId;

Expand Down Expand Up @@ -203,6 +209,10 @@ public Date getCreated() {
return created;
}

public Date getRemoved() {
return removed;
}

protected FirewallRuleVO() {
uuid = UUID.randomUUID().toString();
}
Expand Down
8 changes: 8 additions & 0 deletions engine/schema/src/main/java/org/apache/cloudstack/region/gslb/GlobalLoadBalancerRuleVO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@

package org.apache.cloudstack.region.gslb;

import java.util.Date;
import java.util.UUID;

import javax.persistence.Column;
Expand All @@ -27,8 +28,11 @@
import javax.persistence.GenerationType;
import javax.persistence.Id;
import javax.persistence.Table;
import javax.persistence.Temporal;
import javax.persistence.TemporalType;

import com.cloud.region.ha.GlobalLoadBalancerRule;
import com.cloud.utils.db.GenericDao;
import org.apache.cloudstack.utils.reflectiontostringbuilderutils.ReflectionToStringBuilderUtils;

@Entity
Expand Down Expand Up @@ -74,6 +78,10 @@ public class GlobalLoadBalancerRuleVO implements GlobalLoadBalancerRule {
@Column(name = "state")
GlobalLoadBalancerRule.State state;

@Column(name = GenericDao.REMOVED_COLUMN)
@Temporal(value = TemporalType.TIMESTAMP)
private Date removed;

public GlobalLoadBalancerRuleVO() {
uuid = UUID.randomUUID().toString();
}
Expand Down
19 changes: 19 additions & 0 deletions engine/schema/src/main/resources/META-INF/db/schema-42210to42300.sql
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -131,3 +131,22 @@ CREATE TABLE IF NOT EXISTS `cloud_usage`.`quota_tariff_usage` (
-- Add the 'keep_mac_address_on_public_nic' column to the 'cloud.networks' and 'cloud.vpc' tables
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.networks', 'keep_mac_address_on_public_nic', 'TINYINT(1) NOT NULL DEFAULT 1');
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.vpc', 'keep_mac_address_on_public_nic', 'TINYINT(1) NOT NULL DEFAULT 1');

-- Soft delete port forwarding, load balancing and firewall rules
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.firewall_rules', 'removed', 'datetime DEFAULT NULL');
Copy link
Copy Markdown
Member

@weizhouapache weizhouapache Apr 14, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

it is a very good idea to add removed column to firewall rules/lbs/pf rules.
for other tables, I suspect if the changes are necessary

Copy link
Copy Markdown
Member Author

@bernardodemarco bernardodemarco May 19, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@weizhouapache, thanks for your review!

Regarding the tables firewall_rules, load_balancer_vm_map, load_balancer_cert_map, load_balancer_healthcheck_policies, and load_balancer_stickiness_policies, we should keep the removed column to preserve a complete overview of the LB, FW and PF metadata.

However, for the tables global_load_balancer_lb_rule_map, elastic_lb_vm_map, tungsten_lb_health_monitor, and global_load_balancing_rules, I believe they are related to legacy ACS features. Personally, I have never seen them being used. I added the removed column to maintain consistency with the existing standard/pattern, but I can remove these changes if you think that would be preferable. Let me know your thoughts on this.

Copy link
Copy Markdown
Member

@weizhouapache weizhouapache May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The removed columns are fine with me; however, they do increase the scope of the PR.
As you can see, several DAO/VO/Impl classes need to be reviewed and updated accordingly.

Let’s see whether there are any regressions. If not, I think we can keep them.

CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.load_balancer_vm_map', 'removed', 'datetime DEFAULT NULL');
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.load_balancer_cert_map', 'removed', 'datetime DEFAULT NULL');
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.load_balancer_healthcheck_policies', 'removed', 'datetime DEFAULT NULL');
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.load_balancer_stickiness_policies', 'removed', 'datetime DEFAULT NULL');
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.global_load_balancer_lb_rule_map', 'removed', 'datetime DEFAULT NULL');
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.elastic_lb_vm_map', 'removed', 'datetime DEFAULT NULL');
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.tungsten_lb_health_monitor', 'removed', 'datetime DEFAULT NULL');
CALL `cloud`.`IDEMPOTENT_ADD_COLUMN`('cloud.global_load_balancing_rules', 'removed', 'datetime DEFAULT NULL');

ALTER TABLE `cloud`.`load_balancer_vm_map`
DROP KEY `load_balancer_id`,
ADD UNIQUE KEY `load_balancer_id` (`load_balancer_id`, `instance_id`, `instance_ip`, `removed`);

ALTER TABLE `cloud`.`global_load_balancer_lb_rule_map`
DROP KEY `gslb_rule_id`,
ADD UNIQUE KEY `gslb_rule_id` (`gslb_rule_id`, `lb_rule_id`, `removed`);
Copy link
Copy Markdown
Member

@weizhouapache weizhouapache May 20, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

any keys in other tables need to be updated ?

9 changes: 9 additions & 0 deletions ...twork-elements/elastic-loadbalancer/src/main/java/com/cloud/network/ElasticLbVmMapVO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,11 +27,16 @@
import javax.persistence.SecondaryTable;
import javax.persistence.SecondaryTables;
import javax.persistence.Table;
import javax.persistence.Temporal;
import javax.persistence.TemporalType;

import com.cloud.utils.db.GenericDao;
import org.apache.cloudstack.api.InternalIdentity;

import com.cloud.utils.net.Ip;

import java.util.Date;

@Entity
@Table(name = "elastic_lb_vm_map")
@SecondaryTables({@SecondaryTable(name = "user_ip_address", pkJoinColumns = {@PrimaryKeyJoinColumn(name = "ip_addr_id", referencedColumnName = "id")})})
Expand All @@ -57,6 +62,10 @@ public class ElasticLbVmMapVO implements InternalIdentity {
@Enumerated(value = EnumType.STRING)
private Ip address = null;

@Column(name = GenericDao.REMOVED_COLUMN)
@Temporal(value = TemporalType.TIMESTAMP)
private Date removed;

public ElasticLbVmMapVO() {
}

Expand Down
8 changes: 8 additions & 0 deletions ...main/java/org/apache/cloudstack/network/tungsten/dao/TungstenFabricLBHealthMonitorVO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,9 +16,11 @@
// under the License.
package org.apache.cloudstack.network.tungsten.dao;

import com.cloud.utils.db.GenericDao;
import org.apache.cloudstack.api.Identity;
import org.apache.cloudstack.api.InternalIdentity;

import java.util.Date;
import java.util.UUID;

import javax.persistence.Column;
Expand All @@ -28,6 +30,8 @@
import javax.persistence.Id;
import javax.persistence.PrimaryKeyJoinColumn;
import javax.persistence.Table;
import javax.persistence.Temporal;
import javax.persistence.TemporalType;

@Entity
@Table(name = "tungsten_lb_health_monitor")
Expand Down Expand Up @@ -66,6 +70,10 @@ public class TungstenFabricLBHealthMonitorVO implements InternalIdentity, Identi
@Column(name = "url_path")
private String urlPath;

@Column(name = GenericDao.REMOVED_COLUMN)
@Temporal(value = TemporalType.TIMESTAMP)
private Date removed = null;

public TungstenFabricLBHealthMonitorVO() {
this.uuid = UUID.randomUUID().toString();
}
Expand Down
8 changes: 7 additions & 1 deletion server/src/main/java/com/cloud/network/lb/LoadBalancingRulesManagerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -862,7 +862,7 @@ public boolean deleteLBStickinessPolicy(long stickinessPolicyId, boolean apply)
success = false;
}
} else {
_lb2stickinesspoliciesDao.expunge(stickinessPolicyId);
_lb2stickinesspoliciesDao.remove(stickinessPolicyId);
}
return success;
}
Expand Down Expand Up @@ -1664,6 +1664,12 @@ public List<LoadBalancerVMMapVO> doInTransaction(TransactionStatus status) {
_lb2healthcheckDao.persist(lbHealthCheck);
}

List<LBStickinessPolicyVO> stickinessPolicies = _lb2stickinesspoliciesDao.listByLoadBalancerId(loadBalancerId);
for (LBStickinessPolicyVO stickinessPolicy : stickinessPolicies) {
stickinessPolicy.setRevoke(true);
_lb2stickinesspoliciesDao.persist(stickinessPolicy);
}

if (generateUsageEvent) {
// Generate usage event right after all rules were marked for revoke
Network network = _networkModel.getNetwork(lb.getNetworkId());
Expand Down
Loading