feat(rest-api): Recovery of missing VPC Prefixes from Site inventory

rest-api/db/pkg/db/ipam/ipam.go

@@ -109,7 +109,7 @@ func GetIpamUsageForIPBlock(ctx context.Context, ipamDB cipam.Storage, ipBlock *
 	ipamPrefix := ipamer.PrefixFrom(ctx, cidr)
 
 	if ipamPrefix == nil {
-		return nil, errors.New(fmt.Sprintf("did not find prefix for IPBlock: %s", ipBlock.ID.String()))
+		return nil, fmt.Errorf("did not find prefix for IPBlock: %s", ipBlock.ID)
 	}
 
 	// Handle full grant scenario
@@ -144,7 +144,7 @@ func CreateChildIpamEntryForIPBlock(ctx context.Context, tx *cdb.Tx, dbSession *
 	// we can reason better wrt correctness.
 	// TODO: look into implementing full grant in cloud-ipam library.
 	if parentIPBlock.FullGrant {
-		return nil, errors.New(fmt.Sprintf("parent IPBlock : %s already has a full-grant", parentIPBlock.ID.String()))
+		return nil, fmt.Errorf("parent IPBlock %s already has a full grant", parentIPBlock.ID)
 	}
 	ipamer := cipam.NewWithStorage(ipamDB)
 	namespace := GetIpamNamespaceForIPBlock(ctx, parentIPBlock.RoutingType, parentIPBlock.InfrastructureProviderID.String(), parentIPBlock.SiteID.String())
@@ -154,7 +154,7 @@ func CreateChildIpamEntryForIPBlock(ctx context.Context, tx *cdb.Tx, dbSession *
 	if childBlockSize == parentIPBlock.PrefixLength {
 		parentPrefix := ipamer.PrefixFrom(ctx, parentCidr)
 		if parentPrefix == nil {
-			return nil, errors.New(fmt.Sprintf("did not find prefix for parentIPBlock: %s", parentIPBlock.ID.String()))
+			return nil, fmt.Errorf("did not find prefix for parentIPBlock: %s", parentIPBlock.ID)
 		}
 		parentUsage := parentPrefix.Usage()
 		if parentUsage.AcquiredPrefixes > 0 {
@@ -183,6 +183,34 @@ func CreateChildIpamEntryForIPBlock(ctx context.Context, tx *cdb.Tx, dbSession *
 	return childPrefix, err
 }
 
+// AcquireSpecificChildIpamEntryForIPBlock will create a child ipam entry in the ipam DB for the
+// given parent IP Block, using an exact child cidr instead of letting ipam choose one
+// Note: FullGrant is tracked only in the REST DB, so the ipam DB reports a fully granted parent as
+// empty. The caller must go through this helper (rather than the ipam library directly) so a
+// fully granted parent cannot hand out an overlapping child prefix
+func AcquireSpecificChildIpamEntryForIPBlock(ctx context.Context, tx *cdb.Tx, dbSession *cdb.Session, ipamDB cipam.Storage, parentIPBlock *cdbm.IPBlock, childCidr string) (*cipam.Prefix, error) {
+	if parentIPBlock == nil {
+		return nil, ErrNilIPBlock
+	}
+	if parentIPBlock.FullGrant {
+		return nil, fmt.Errorf("parent IPBlock %s already has a full grant", parentIPBlock.ID)
+	}
+	ipamer := cipam.NewWithStorage(ipamDB)
+	namespace := GetIpamNamespaceForIPBlock(ctx, parentIPBlock.RoutingType, parentIPBlock.InfrastructureProviderID.String(), parentIPBlock.SiteID.String())
+	ipamer.SetNamespace(namespace)
+	parentCidr := GetCidrForIPBlock(ctx, parentIPBlock.Prefix, parentIPBlock.PrefixLength)
+	// A child equal to the parent is a full grant. That path must go through
+	// CreateChildIpamEntryForIPBlock so the REST DB FullGrant flag stays consistent.
+	if childCidr == parentCidr {
+		return nil, fmt.Errorf("child CIDR %s equals parent CIDR %s for IPBlock %s; use CreateChildIpamEntryForIPBlock", childCidr, parentCidr, parentIPBlock.ID)
+	}
+	childPrefix, err := ipamer.AcquireSpecificChildPrefix(ctx, parentCidr, childCidr)
+	if err != nil {
+		return nil, err
+	}
+	return childPrefix, nil
+}
+
 // DeleteChildIpamEntryFromCidr will delete a child ipam entry in the ipam DB
 // given the parent IPBlock, and child cidr
 // Note: FullGrant is a special case when the parentIPBlock has a full grant, and the child
@@ -198,7 +226,7 @@ func DeleteChildIpamEntryFromCidr(ctx context.Context, tx *cdb.Tx, dbSession *cd
 		// this is a consistency check
 		if parentCidr != childCidr {
 			// this should never happen, ie, in a full grant, parent cidr and child cidr should match
-			return errors.New(fmt.Sprintf("parent IPBlock has full-grant, but childCidr: %s does not match parentCidr: %s", childCidr, parentCidr))
+			return fmt.Errorf("parent IPBlock has full grant, but child CIDR %s does not match parent CIDR %s", childCidr, parentCidr)
 		}
 		ipbDAO := cdbm.NewIPBlockDAO(dbSession)
 		_, err := ipbDAO.Update(
@@ -211,7 +239,7 @@ func DeleteChildIpamEntryFromCidr(ctx context.Context, tx *cdb.Tx, dbSession *cd
 		)
 
 		if err != nil {
-			return errors.New(fmt.Sprintf("unable to update IPBlock's full-grant, ipblock id: %s ", parentIPBlock.ID.String()))
+			return fmt.Errorf("unable to update IPBlock full grant for IPBlock %s", parentIPBlock.ID)
 		}
 		parentIPBlock.FullGrant = false
 		return nil

rest-api/db/pkg/db/ipam/ipam_test.go

@@ -10,12 +10,12 @@ import (
 
 	cutil "github.com/NVIDIA/infra-controller/rest-api/common/pkg/util"
 	"github.com/NVIDIA/infra-controller/rest-api/db/pkg/db"
-	cdb "github.com/NVIDIA/infra-controller/rest-api/db/pkg/db"
 	cdbm "github.com/NVIDIA/infra-controller/rest-api/db/pkg/db/model"
 	cdbutil "github.com/NVIDIA/infra-controller/rest-api/db/pkg/util"
 	cipam "github.com/NVIDIA/infra-controller/rest-api/ipam"
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 	"github.com/uptrace/bun/extra/bundebug"
 )
 
@@ -34,19 +34,19 @@ func getTestIpamer(t *testing.T, ipamDB cipam.Storage) cipam.Ipamer {
 func getTestIpamDB(t *testing.T, dbSession *db.Session, reset bool) cipam.Storage {
 	if testIpamDB != nil {
 		if reset {
-			testIpamDB.DeleteAllPrefixes(context.Background(), "")
+			require.NoError(t, testIpamDB.DeleteAllPrefixes(context.Background(), ""))
 		}
 		return testIpamDB
 	}
 
 	storage := cipam.NewBunStorage(dbSession.DB, nil)
 
 	// ensure the ipam schema is applied in test db
-	storage.ApplyDbSchema()
+	require.NoError(t, storage.ApplyDbSchema())
 
 	testIpamDB := NewIpamStorage(dbSession.DB, nil)
 	if reset {
-		testIpamDB.DeleteAllPrefixes(context.Background(), "")
+		require.NoError(t, testIpamDB.DeleteAllPrefixes(context.Background(), ""))
 	}
 	return testIpamDB
 }
@@ -463,7 +463,7 @@ func TestCreateChildIpamEntryForIPBlock(t *testing.T) {
 	tests := []struct {
 		name              string
 		parentIPBlock     *cdbm.IPBlock
-		tx                *cdb.Tx
+		tx                *db.Tx
 		childCount        int
 		childPrefixLength int
 		expectedErr       bool
@@ -649,7 +649,7 @@ func TestDeleteChildIpamEntryFromCidr(t *testing.T) {
 	tests := []struct {
 		name           string
 		parentIPBlock  *cdbm.IPBlock
-		tx             *cdb.Tx
+		tx             *db.Tx
 		childCidr      string
 		expectedErr    bool
 		checkFullGrant bool
@@ -708,6 +708,100 @@ func TestDeleteChildIpamEntryFromCidr(t *testing.T) {
 	}
 }
 
+func TestAcquireSpecificChildIpamEntryForIPBlock(t *testing.T) {
+	dbSession := cdbutil.GetTestDBSession(t, false)
+	defer dbSession.Close()
+	dbSession.DB.AddQueryHook(bundebug.NewQueryHook(
+		bundebug.WithEnabled(false),
+		bundebug.FromEnv("BUNDEBUG"),
+	))
+	ipamDB := getTestIpamDB(t, dbSession, true)
+	ctx := context.Background()
+	testIpamSetupSchema(t, dbSession)
+
+	ip := testIpamBuildInfrastructureProvider(t, dbSession, "testip-specific")
+	site := testIpamBuildSite(t, dbSession, ip, "testsite-specific")
+
+	parent := &cdbm.IPBlock{
+		RoutingType:              cdbm.IPBlockRoutingTypeDatacenterOnly,
+		InfrastructureProviderID: ip.ID,
+		SiteID:                   site.ID,
+		Prefix:                   "10.20.0.0",
+		PrefixLength:             16,
+		FullGrant:                false,
+		ProtocolVersion:          cdbm.IPBlockProtocolVersionV4,
+	}
+	ipamer := cipam.NewWithStorage(ipamDB)
+	ipamer.SetNamespace(GetIpamNamespaceForIPBlock(ctx, parent.RoutingType, parent.InfrastructureProviderID.String(), parent.SiteID.String()))
+	prefix, err := ipamer.NewPrefix(ctx, "10.20.0.0/16")
+	assert.Nil(t, err)
+	assert.Equal(t, "10.20.0.0/16", prefix.Cidr)
+
+	fullGrantParent := &cdbm.IPBlock{
+		ID:                       uuid.New(),
+		RoutingType:              cdbm.IPBlockRoutingTypeDatacenterOnly,
+		InfrastructureProviderID: ip.ID,
+		SiteID:                   site.ID,
+		Prefix:                   "10.21.0.0",
+		PrefixLength:             16,
+		FullGrant:                true,
+		ProtocolVersion:          cdbm.IPBlockProtocolVersionV4,
+	}
+
+	tests := []struct {
+		name          string
+		parentIPBlock *cdbm.IPBlock
+		childCidr     string
+		expectedErr   bool
+		expectedError string
+	}{
+		{
+			name:          "success acquiring specific child",
+			parentIPBlock: parent,
+			childCidr:     "10.20.1.0/24",
+			expectedErr:   false,
+		},
+		{
+			name:          "failure when child equals parent",
+			parentIPBlock: parent,
+			childCidr:     "10.20.0.0/16",
+			expectedErr:   true,
+			expectedError: fmt.Sprintf(
+				"child CIDR 10.20.0.0/16 equals parent CIDR 10.20.0.0/16 for IPBlock %s; use CreateChildIpamEntryForIPBlock",
+				parent.ID,
+			),
+		},
+		{
+			name:          "failure when parent is fully granted",
+			parentIPBlock: fullGrantParent,
+			childCidr:     "10.21.1.0/24",
+			expectedErr:   true,
+			expectedError: fmt.Sprintf("parent IPBlock %s already has a full grant", fullGrantParent.ID),
+		},
+		{
+			name:          "failure when parent is nil",
+			parentIPBlock: nil,
+			childCidr:     "10.20.2.0/24",
+			expectedErr:   true,
+		},
+	}
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			child, err := AcquireSpecificChildIpamEntryForIPBlock(ctx, nil, dbSession, ipamDB, tc.parentIPBlock, tc.childCidr)
+			assert.Equal(t, tc.expectedErr, err != nil)
+			if tc.expectedError != "" {
+				assert.EqualError(t, err, tc.expectedError)
+			}
+			if tc.expectedErr {
+				assert.Nil(t, child)
+				return
+			}
+			assert.NotNil(t, child)
+			assert.Equal(t, tc.childCidr, child.Cidr)
+		})
+	}
+}
+
 // Generic IPAM library tests from the api
 func TestIpamer_NewPrefix(t *testing.T) {
 	// test ipam operations from api

rest-api/db/pkg/db/model/ipblock.go

@@ -6,6 +6,8 @@ package model
 import (
 	"context"
 	"database/sql"
+	"fmt"
+	"net/netip"
 	"time"
 
 	"github.com/NVIDIA/infra-controller/rest-api/db/pkg/db"
@@ -96,6 +98,19 @@ type IPBlock struct {
 	CreatedBy                *uuid.UUID              `bun:"created_by,type:uuid"`
 }
 
+// ContainsPrefix reports whether prefix belongs to this IPBlock.
+func (ipb *IPBlock) ContainsPrefix(prefix netip.Prefix) bool {
+	if ipb == nil {
+		return false
+	}
+
+	ipBlockPrefix, err := netip.ParsePrefix(fmt.Sprintf("%s/%d", ipb.Prefix, ipb.PrefixLength))
+	return err == nil &&
+		ipBlockPrefix.Addr().BitLen() == prefix.Addr().BitLen() &&
+		ipBlockPrefix.Bits() <= prefix.Bits() &&
+		ipBlockPrefix.Contains(prefix.Addr())
+}
+
 // IPBlockCreateInput input parameters for Create method
 type IPBlockCreateInput struct {
 	IPBlockID                *uuid.UUID
@@ -156,6 +171,8 @@ type IPBlockFilterInput struct {
 	ExcludeDerived            bool
 	ExcludeTenantSitePrefixes bool
 	SearchQuery               *string
+	// IncludeDeleted returns soft-deleted rows in addition to active ones.
+	IncludeDeleted bool
 }
 
 // ProviderVisible applies the provider's IPBlock visibility rules to the filter.
@@ -475,6 +492,9 @@ func (ipbsd IPBlockSQLDAO) GetAll(ctx context.Context, tx *db.Tx, filter IPBlock
 	ipbs := []IPBlock{}
 
 	query := db.GetIDB(tx, ipbsd.dbSession).NewSelect().Model(&ipbs)
+	if filter.IncludeDeleted {
+		query = query.WhereAllWithDeleted()
+	}
 	query, err := ipbsd.setQueryWithFilter(query, filter, ipblockDAOSpan)
 	if err != nil {
 		return nil, 0, err