Skip to content

[fix] match firewall devices by entity type as well as ID - #656

Open
lbarrosby wants to merge 1 commit into
linode:mainfrom
lbarrosby:fix-firewall-device-entity-type
Open

lbarrosby wants to merge 1 commit into
linode:mainfrom
lbarrosby:fix-firewall-device-entity-type

Conversation

@lbarrosby

Copy link
Copy Markdown
Contributor

Description

getNodeBalancerDeviceID finds the NodeBalancer among a firewall's devices by Entity.ID only. Linodes, Linode interfaces and NodeBalancers have separate ID spaces, so on a firewall that protects both a Linode and the service's NodeBalancer (for example a user managed firewall passed with firewall-id that also covers the cluster nodes), a Linode whose ID equals the NodeBalancer ID can be returned instead.

Both callers then delete the wrong device:

  • switching the firewall-id annotation (attachAndReplaceNBFirewall) detaches the Linode from the old firewall and leaves the NodeBalancer attached to both;
  • removing the firewall annotations (UpdateNodeBalancerFirewall with no annotation) detaches the Linode and keeps the NodeBalancer on the firewall.

The fix only matches devices whose entity type is nodebalancer (linodego.FirewallDeviceNodeBalancer).

Tests in cloud/linode/services/firewalls_device_test.go use a firewall with a linode device and a nodebalancer device sharing the same entity ID, plus a linode_interface device. On main they fail with the Linode device being removed:

--- FAIL: TestReplaceNBFirewallKeepsLinodeWithSameID (0.00s)
    firewalls.go:533: Unexpected call to *mocks.MockClient.DeleteFirewallDevice([context.Background.WithCancel 1 10]) ...
--- FAIL: TestRemoveNBFirewallKeepsLinodeWithSameID (0.00s)
    firewalls.go:429: Unexpected call to *mocks.MockClient.DeleteFirewallDevice([context.Background.WithCancel 1 10]) ...

With the change:

$ go test ./cloud/...
ok  	github.com/linode/linode-cloud-controller-manager/cloud/linode
ok  	github.com/linode/linode-cloud-controller-manager/cloud/linode/services
...
$ golangci-lint run -c .golangci.yml ./cloud/...
No issues found

General:

  • Have you removed all sensitive information, including but not limited to access keys and passwords?
  • Have you checked to ensure there aren't other open or closed Pull Requests for the same bug/feature/question?

Pull Request Guidelines:

  1. Does your submission pass tests?
  2. Have you added tests?
  3. Are you addressing a single feature in this PR?
  4. Are your commits atomic, addressing one change per commit?
  5. Are you following the conventions of the language?
  6. Have you saved your large formatting changes for a different PR, so we can focus on your work?
  7. Have you explained your rationale for why this feature is needed?
  8. Have you linked your PR to an open issue

getNodeBalancerDeviceID looked for the NodeBalancer among the firewall
devices by entity ID only. Linodes, Linode interfaces and NodeBalancers
use separate ID spaces, so a firewall shared by a Linode and the
NodeBalancer could return the Linode device when both IDs are equal.
Replacing or removing the NodeBalancer firewall then detached the
Linode from its firewall and left the NodeBalancer attached.

Only match devices whose entity type is nodebalancer.

Signed-off-by: Lucas Barros <lucasbarros.kam@gmail.com>
@lbarrosby
lbarrosby requested review from a team as code owners November 8, 2026 10:01
@github-actions github-actions Bot added the bugfix for any bug fixes in the changelog. label Nov 8, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bugfix for any bug fixes in the changelog.

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant