NSX: configure segment discovery and security profiles by Dogface2k · Pull Request #13791 · apache/cloudstack

Dogface2k · 2026-08-04T18:36:04Z

Summary

expose optional IP discovery, MAC discovery, and segment security profiles on NSX network offerings;
validate that referenced profiles resolve to the requested canonical resource and are not marked for deletion;
bind selected profiles in the same hierarchical NSX request as segment creation;
reject profile changes on existing networks instead of silently reconfiguring an active segment;
add focused API, NSX client, resource, guru, and configuration coverage.

When no profiles are configured, segment creation keeps the existing behavior. This change is limited to NSX segment profile configuration; DHCP/IPAM and Kubernetes load-balancer rule regeneration are not part of this PR.

Validation

The branch is based on CloudStack main at 4f117071c9.

Focused coverage includes:

segment creation with all supported profile bindings;
individual IP discovery, MAC discovery, and segment security bindings;
preservation of the existing segment PATCH path when no profiles are selected;
rejection of non-canonical, mismatched, and marked-for-deletion profiles;
the VMware NotFound profile lookup path, asserting a clean CloudRuntimeException and no segment or Infra mutation;
profile propagation through the resource and guest-network guru layers;
network-offering validation and upgrade compatibility.

DaanHoogland · 2026-08-05T07:38:41Z

+        InternalLbProvider, PublicLbProvider, servicepackageuuid, servicepackagedescription, PromiscuousMode, MacAddressChanges, ForgedTransmits, MacLearning,
+        NsxIpDiscoveryProfileId, NsxMacDiscoveryProfileId, NsxSegmentSecurityProfileId,
+        RelatedNetworkOffering, domainid, zoneid, pvlanType, internetProtocol


maybe a good moment to just format one/line? (no req, just suggestion for readability)

codecov · 2026-08-05T07:45:36Z

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 3.41%. Comparing base (4f11707) to head (d94fafd).

❗ There is a different number of reports uploaded between BASE (4f11707) and HEAD (d94fafd). Click for more details.

HEAD has 1 upload less than BASE

Flag BASE (4f11707) HEAD (d94fafd)

unittests 1 0

Additional details and impacted files

@@              Coverage Diff              @@
##               main   #13791       +/-   ##
=============================================
- Coverage     19.65%    3.41%   -16.24%     
=============================================
  Files          6368      487     -5881     
  Lines        574881    41881   -533000     
  Branches      70351     7918    -62433     
=============================================
- Hits         112970     1429   -111541     
+ Misses       449639    40252   -409387     
+ Partials      12272      200    -12072

Flag	Coverage Δ
uitests	`3.41% <ø> (-0.01%)`	⬇️
unittests	`?`

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Copilot

Pull request overview

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

This PR adds support for configuring NSX segment discovery/security profiles via network offering details, validates these settings server-side, passes the selected profile IDs through the agent command path, and updates UI/i18n and unit tests accordingly.

Changes:

Expose NSX profile ID fields (IP discovery, MAC discovery, segment security) in Add/Clone Network Offering UI and persist them via offering details.
Validate NSX profile detail constraints (NSX-only, non-blank, no surrounding whitespace, max length) and prevent offering upgrades when profile bindings differ.
Extend NSX segment creation to resolve/validate profile paths and bind profiles in the same hierarchical Infra request; add targeted unit tests.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
ui/src/views/offering/CloneNetworkOffering.vue	Adds NSX profile input fields and submits them as offering details during clone.
ui/src/views/offering/AddNetworkOffering.vue	Adds NSX profile input fields and includes them in the details key set for submission.
ui/public/locales/en.json	Adds labels/tooltips for the new NSX profile fields.
server/src/test/java/com/cloud/network/NetworkServiceImplTest.java	Adds tests for offering-upgrade behavior based on NSX profile bindings.
server/src/test/java/com/cloud/configuration/ConfigurationManagerImplTest.java	Adds tests for NSX profile detail validation rules.
server/src/main/java/com/cloud/network/NetworkServiceImpl.java	Rejects offering upgrades when NSX segment profile bindings differ.
server/src/main/java/com/cloud/configuration/ConfigurationManagerImpl.java	Validates NSX segment profile details (NSX-only + formatting/length rules).
plugins/network-elements/nsx/src/test/java/org/apache/cloudstack/service/NsxGuestNetworkGuruTest.java	Verifies profile IDs from offering details are passed into CreateNsxSegmentCommand.
plugins/network-elements/nsx/src/test/java/org/apache/cloudstack/service/NsxApiClientTest.java	Adds tests for binding behavior, validation failures, and “no profiles” behavior.
plugins/network-elements/nsx/src/test/java/org/apache/cloudstack/resource/NsxResourceTest.java	Verifies CreateNsxSegmentCommand profile IDs are forwarded to NsxApiClient.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/utils/NsxHelper.java	Adds overload to build CreateNsxSegmentCommand with optional profile IDs.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/service/NsxGuestNetworkGuru.java	Reads offering details and passes profile IDs into segment creation command.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/service/NsxApiClient.java	Resolves/validates profile paths and issues Infra.patch to create segment + bindings atomically.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/resource/NsxResource.java	Calls NsxApiClient.createSegment with the profile ID arguments.
plugins/network-elements/nsx/src/main/java/org/apache/cloudstack/agent/api/CreateNsxSegmentCommand.java	Adds profile ID fields and constructor overload for segment creation.
api/src/main/java/org/apache/cloudstack/api/command/admin/network/NetworkOfferingBaseCmd.java	Documents the new NSX offering detail keys in the API parameter description.
api/src/main/java/com/cloud/offering/NetworkOffering.java	Adds new Detail enum values for the NSX profile ID keys.
PendingReleaseNotes	Adds release note entry describing NSX offering profile binding behavior.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+        if (values.nsxsegmentsecurityprofileid) {
+          params['details[' + detailsIndex + '].key'] = 'nsxsegmentsecurityprofileid'
+          params['details[' + detailsIndex + '].value'] = values.nsxsegmentsecurityprofileid
+        }


+        <a-row :gutter="12" v-if="form.provider === 'NSX'">
+          <a-col :md="8" :lg="8">
+            <a-form-item name="nsxipdiscoveryprofileid" ref="nsxipdiscoveryprofileid">
+              <template #label>
+                <tooltip-label
+                  :title="$t('label.nsx.ip.discovery.profile.id')"
+                  :tooltip="$t('message.network.offering.nsx.ip.discovery.profile.id')"/>
+              </template>
+              <a-input v-model:value="form.nsxipdiscoveryprofileid" :maxlength="255" />
+            </a-form-item>
+          </a-col>
+          <a-col :md="8" :lg="8">
+            <a-form-item name="nsxmacdiscoveryprofileid" ref="nsxmacdiscoveryprofileid">
+              <template #label>
+                <tooltip-label
+                  :title="$t('label.nsx.mac.discovery.profile.id')"
+                  :tooltip="$t('message.network.offering.nsx.mac.discovery.profile.id')"/>
+              </template>
+              <a-input v-model:value="form.nsxmacdiscoveryprofileid" :maxlength="255" />
+            </a-form-item>
+          </a-col>
+          <a-col :md="8" :lg="8">
+            <a-form-item name="nsxsegmentsecurityprofileid" ref="nsxsegmentsecurityprofileid">
+              <template #label>
+                <tooltip-label
+                  :title="$t('label.nsx.segment.security.profile.id')"
+                  :tooltip="$t('message.network.offering.nsx.segment.security.profile.id')"/>
+              </template>
+              <a-input v-model:value="form.nsxsegmentsecurityprofileid" :maxlength="255" />
+            </a-form-item>
+          </a-col>
+        </a-row>


+        for (NetworkOffering.Detail detail : List.of(NetworkOffering.Detail.NsxIpDiscoveryProfileId,
+                NetworkOffering.Detail.NsxMacDiscoveryProfileId, NetworkOffering.Detail.NsxSegmentSecurityProfileId)) {


+    protected String getIpDiscoveryProfilePath(String profileId) {
+        if (StringUtils.isBlank(profileId)) {
+            return null;
+        }
+        IpDiscoveryProfiles profiles = (IpDiscoveryProfiles) nsxService.apply(IpDiscoveryProfiles.class);
+        IPDiscoveryProfile profile = profiles.get(profileId);
+        return validateProfile(profileId, profile.getId(), profile.getPath(), "/infra/ip-discovery-profiles/", profile.getMarkedForDelete());
+    }


+import com.vmware.nsx_policy.infra.tier_1s.ipsec_vpn_services.Sessions;
+import com.vmware.nsx_policy.infra.segments.SegmentDiscoveryProfileBindingMaps;
+import com.vmware.nsx_policy.infra.segments.SegmentSecurityProfileBindingMaps;


Dogface2k · 2026-08-05T11:34:04Z

+import com.vmware.nsx_policy.model.StaticRoutesListResult;
+import com.vmware.nsx_policy.model.Tag;
+import com.vmware.nsx_policy.model.Tier1;
+import com.vmware.nsx_policy.model.TunnelInterfaceIPSubnet;


I have stuff missing hence why this is a draft I will be going through everything shortly.

no pressure (or at least you shouldn’t percieve any ;)

NSX: support segment discovery and security profiles

9e46c65

boring-cyborg Bot added component:api component:networking component:UI labels Aug 4, 2026

NSX: complete segment profile validation and hierarchy

d94fafd

Dogface2k force-pushed the feature/nsx-segment-profile-bindings branch from dc7d4bc to d94fafd Compare August 4, 2026 19:00

DaanHoogland requested a lite review from Copilot August 5, 2026 07:37

DaanHoogland reviewed Aug 5, 2026

View reviewed changes

Copilot AI reviewed Aug 5, 2026

View reviewed changes

Copilot started reviewing on behalf of DaanHoogland August 5, 2026 08:18 View session

Dogface2k added 3 commits August 6, 2026 00:32

test: cover missing NSX segment profiles

0c52c26

style: format network offering details

369c1b0

ui: keep cloned offering detail indexes consistent

f3456b9

Navigation Menu

Uh oh!

NSX: configure segment discovery and security profiles - #13791

NSX: configure segment discovery and security profiles#13791
Dogface2k wants to merge 5 commits into
apache:mainfrom
Dogface2k:feature/nsx-segment-profile-bindings

Dogface2k commented Aug 4, 2026 •

edited

Loading

Uh oh!

DaanHoogland Aug 5, 2026

Uh oh!

codecov Bot commented Aug 5, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Dogface2k Aug 5, 2026

Uh oh!

DaanHoogland Aug 5, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

		for (NetworkOffering.Detail detail : List.of(NetworkOffering.Detail.NsxIpDiscoveryProfileId,
		NetworkOffering.Detail.NsxMacDiscoveryProfileId, NetworkOffering.Detail.NsxSegmentSecurityProfileId)) {

Uh oh!

Conversation

Dogface2k commented Aug 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

DaanHoogland Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

codecov Bot commented Aug 5, 2026

Codecov Report

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Dogface2k Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

DaanHoogland Aug 5, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Dogface2k commented Aug 4, 2026 •

edited

Loading