<fix>[securityGroup]: ovn vm don't check host sg rule #3133
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Resolves: ZSTAC-80893 Change-Id: I666c646a6a686379737877726469787572636562
演练在 RefreshSecurityGroupRulesOnVmMsg 处理的完成路径中进行了修改：当不存在"其他"网卡（即所有网卡都连接到相同 SDN 后端）时，现在方法会立即回复，无需调用对剩余网卡的刷新。之前会继续刷新剩余网卡后再回复。 变更
预估代码审查工作量🎯 2 (简单) | ⏱️ ~8 分钟 诗
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ast-grep (0.40.3)plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupManagerImpl.javaComment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupManagerImpl.java (1)
1067-1070: 逻辑正确，优化合理这段代码实现了针对 OVN 虚拟机的重要修复：当所有网卡都连接到 SDN 后端时，提前返回并跳过主机侧安全组规则的刷新。这符合 PR 目标（"ovn vm don't check host sg rule"）。
代码逻辑分析：
otherNicUuids包含非 SDN 网卡（第 1057 行）- 如果为空，说明所有网卡都是 SDN 类型（如 OVN）
- 这种情况下无需调用
refreshVmSecurityGroupRules处理主机侧规则- 提前返回还避免了第 1072 行的重复应答
💡 可选：增加注释提升代码可读性
建议添加简短注释说明跳过的原因，便于后续维护：
+ // SDN-based NICs (e.g., OVN) don't require host-based security group rules if (otherNicUuids.isEmpty()) { bus.reply(msg, reply); return; }
📜 Review details
Configuration used: Path: http://open.zstack.ai:20001/code-reviews/zstack-cloud.yaml (via .coderabbit.yaml)
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (1)
plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupManagerImpl.java
🧰 Additional context used
📓 Path-based instructions (2)
**/*.*
⚙️ CodeRabbit configuration file
**/*.*: - 代码里不应当有有中文，包括报错、注释等都应当使用正确的、无拼写错误的英文来写
Files:
plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupManagerImpl.java
**/*.java
⚙️ CodeRabbit configuration file
**/*.java: ## 1. API 设计要求
- API 命名：
- API 名称必须唯一，不能重复。
- API 消息类需要继承
APIMessage；其返回类必须继承APIReply或APIEvent，并在注释中用@RestResponse进行标注。- API 消息上必须添加注解
@RestRequest，并满足如下规范：
path:
- 针对资源使用复数形式。
- 当 path 中引用消息类变量时，使用
{variableName}格式。- HTTP 方法对应：
- 查询操作 →
HttpMethod.GET- 更新操作 →
HttpMethod.PUT- 创建操作 →
HttpMethod.POST- 删除操作 →
HttpMethod.DELETE- API 类需要实现
__example__方法以便生成 API 文档，并确保生成对应的 Groovy API Template 与 API Markdown 文件。
2. 命名与格式规范
类名：
- 使用 UpperCamelCase 风格。
- 特殊情况：
- VO/AO/EO 类型类除外。
- 抽象类采用
Abstract或Base前缀/后缀。- 异常类应以
Exception结尾。- 测试类需要以
Test或Case结尾。方法名、参数名、成员变量和局部变量：
- 使用 lowerCamelCase 风格。
常量命名：
- 全部大写，使用下划线分隔单词。
- 要求表达清楚，避免使用含糊或不准确的名称。
包名：
- 统一使用小写，使用点分隔符，每个部分应是一个具有自然语义的英文单词（参考 Spring 框架的结构）。
命名细节：
- 避免在父子类或同一代码块中出现相同名字的成员或局部变量，防止混淆。
- 命名缩写：
- 不允许使用不必要的缩写，如：
AbsSchedulerJob、condi、Fu等。应使用完整单词提升可读性。
3. 编写自解释代码
意图表达：
- 避免使用布尔型参数造成含义不明确。例如：
- 对于
stopAgent(boolean ignoreError)，建议拆分为不同函数（如stopAgentIgnoreError()），或使用枚举表达操作类型。- 命名应尽量用完整的单词组合表达意图，并在名称中体现数据类型或用途（例如在常量与变量名称中，将类型词放在末尾）。
- 避免使用魔法值（Magic Value）：
直接使用未经定义的数值或字符串（如 if (status == 5)）应替换为枚举或常量。
示例：
// 错误示例：魔法值
if (user.getStatus() == 5) { ... }
// 正确示例：常量或枚举
public static final int STATUS_ACTIVE = 5;
if (user.getStatus() == STATUS_ACTIVE) { ... }
// 或使用枚举
enum UserStatus { ACTIVE, INACTIVE }
注释：
- 代码应尽量做到自解释，对少于两行的说明可以直接写在代码中。
- 对于较长的注释，需要仔细校对并随代码更新，确保内容正确。
- 接口方法不应有多余的修饰符（例如
public），且必须配有有效的 Javadoc 注释。
4. 流程控制和结构优化
if...else 的使用：
- 应尽量减少 if...else 结构的使用，建议：
- 限制嵌套层级最多为两层，且内层不应再出现
else分支。- 尽早返回（Early Return），将条件判断中的处理逻辑提前结束或抽成独立方法。
- 使用 Java Stream 或 Lambda 表达式代替冗长的循环与条件判断。
条件判断：
- if 条件表达不宜过长或过于复杂，必要时可以将条件抽成 boolean 变量描述。
代码块长度：
...
Files:
plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupManagerImpl.java
🧠 Learnings (3)
📚 Learning: 2025-08-29T03:35:56.509Z
Learnt from: zstack-robot-2
Repo: MatheMatrix/zstack PR: 2528
File: plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupNetworkServiceExtension.java:134-139
Timestamp: 2025-08-29T03:35:56.509Z
Learning: In ZStack's SecurityGroupNetworkServiceExtension.java applyNetworkService method, there is no need to add null/empty checks for destNics because NetworkServiceManagerImpl.java already performs this validation upstream with `if (spec.getDestNics().isEmpty()) { completion.success(); return; }` before calling applyNetworkService.
Applied to files:
plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupManagerImpl.java
📚 Learning: 2025-08-29T03:35:56.509Z
Learnt from: zstack-robot-2
Repo: MatheMatrix/zstack PR: 2528
File: plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupNetworkServiceExtension.java:134-139
Timestamp: 2025-08-29T03:35:56.509Z
Learning: In ZStack's SecurityGroupNetworkServiceExtension.java applyNetworkService method, there is no need to add null/empty checks for destNics because NetworkServiceManagerImpl.java already performs this validation upstream with `if (spec.getDestNics().isEmpty()) { completion.success(); return; }` before calling applyNetworkService, ensuring destNics will never be empty when reaching the extension methods.
Applied to files:
plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupManagerImpl.java
📚 Learning: 2025-08-10T13:42:01.027Z
Learnt from: MatheMatrix
Repo: MatheMatrix/zstack PR: 2410
File: compute/src/main/java/org/zstack/compute/vm/VmInstanceHelper.java:334-356
Timestamp: 2025-08-10T13:42:01.027Z
Learning: 在 ZStack 的 `VmInstanceHelper.validateVmNicParams` 方法中调用 `VmNicParamValidator` 时，不需要对 msg.getType() 返回 null 的情况进行兼容处理，因为 vmType 为 null 的情况已在内部（VmNicParamValidator 或其他地方）得到处理。
Applied to files:
plugin/securityGroup/src/main/java/org/zstack/network/securitygroup/SecurityGroupManagerImpl.java
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Resolves: ZSTAC-80893
Change-Id: I666c646a6a686379737877726469787572636562
sync from gitlab !8948