ipam: netbox: implement deleting subnets

Deleting a subnet did not delete any created entities in Netbox.
Implement deletion of a subnet by deleting all entities that are
created in Netbox upon creation of a subnet.

We are checking for any leftover IP assignments before deleting the
prefix, so we do not accidentally delete any manually created IP
assignments.

This method tries to check for any possible errors before editing the
entities. There is still a small window where external changes can
occur that lead to errors. We are touching multiple entities here, so
in case of errors users have to fix their Netbox instance manually.

Signed-off-by: Stefan Hanreich <s.hanreich@proxmox.com>
Tested-by: Hannes Duerr <h.duerr@proxmox.com>
Link: https://lore.proxmox.com/20250310085103.30549-2-s.hanreich@proxmox.com
Signed-off-by: Thomas Lamprecht <t.lamprecht@proxmox.com>

diff --git a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
index 56a1787ff6b13cde8477c3cac7755fd90db820b4..f0b70fd7d893527f1189c6f894cd2949b5c89d95 100644 (file)
--- a/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
+++ b/src/PVE/Network/SDN/Ipams/NetboxPlugin.pm
@@ -71,7 +71,22 @@ sub del_subnet {
 
     my $internalid = get_prefix_id($plugin_config, $cidr, $noerr);
 
-    return; #fixme: check that prefix is empty exluding gateway, before delete
+    # definedness check, because ID could be 0
+    if (!defined($internalid)) {
+       warn "could not find id for ip prefix $cidr";
+       return;
+    }
+
+    if (!is_prefix_empty($plugin_config, $cidr, $noerr)) {
+       return if $noerr;
+       die "not deleting prefix $cidr because it still contains entries";
+    }
+
+    # last IP is assumed to be the gateway, delete it
+    if (!$class->del_ip($plugin_config, $subnetid, $subnet, $subnet->{gateway}, $noerr)) {
+       return if $noerr;
+       die "could not delete gateway ip from subnet $subnetid";
+    }
 
     eval {
        netbox_api_request($plugin_config, "DELETE", "/ipam/prefixes/$internalid/");
@@ -217,6 +232,8 @@ sub del_ip {
     if ($@) {
        die "error delete ip $ip : $@" if !$noerr;
     }
+
+    return 1;
 }
 
 sub get_ips_from_mac {
@@ -324,6 +341,19 @@ sub is_ip_gateway {
     return $is_gateway;
 }
 
+sub is_prefix_empty {
+    my ($config, $cidr, $noerr) = @_;
+
+    my $result = eval { netbox_api_request($config, "GET", "/ipam/ip-addresses/?parent=$cidr") };
+    if ($@) {
+       return if $noerr;
+       die "could not query children for prefix $cidr: $@";
+    }
+
+    # checking against 1, because we do not count the gateway
+    return scalar(@{$result->{results}}) <= 1;
+}
+
 1;