Skip to content

network: add default isolated offering with source NAT and egress allowed by default #14286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
weizhouapache wants to merge 2 commits into
base: main
Choose a base branch
from
+59 −19
Open

network: add default isolated offering with source NAT and egress allowed by default #14286

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
622b023
network: add default isolated offering with source NAT and egress all…
weizhouapache Oct 1, 2026
41a9378
network: align upgraded default egress-allowed offering with fresh in…
weizhouapache Oct 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions api/src/main/java/com/cloud/offering/NetworkOffering.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -70,6 +70,7 @@ enum RoutingMode {
public static final String DEFAULT_ROUTED_NSX_OFFERING = "DefaultRoutedNSXNetworkOffering";
public final static String QuickCloudNoServices = "QuickCloudNoServices";
public final static String DefaultIsolatedNetworkOfferingWithSourceNatService = "DefaultIsolatedNetworkOfferingWithSourceNatService";
public final static String DefaultIsolatedNetworkOfferingWithSourceNatServiceDefaultEgressAllowed = "DefaultIsolatedNetworkOfferingWithSourceNatServiceEgressAllowed";

@DaanHoogland DaanHoogland Oct 2, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

any reason for the extra "Default" in the name?

@weizhouapache weizhouapache Oct 2, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

as all other built-in offerings start with Default

image

public final static String OvsIsolatedNetworkOfferingWithSourceNatService = "OvsIsolatedNetworkOfferingWithSourceNatService";
public final static String DefaultSharedNetworkOffering = "DefaultSharedNetworkOffering";
public final static String DefaultIsolatedNetworkOffering = "DefaultIsolatedNetworkOffering";
Expand Down
40 changes: 27 additions & 13 deletions ...tration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -581,19 +581,19 @@ public boolean configure(final String name, final Map<String, Object> params) th
defaultIsolatedSourceNatEnabledNetworkOfferingProviders.put(Service.Vpn, defaultProviders);

final Map<Network.Service, Set<Network.Provider>> defaultVPCOffProviders = new HashMap<>();
defaultProviders.clear();
defaultProviders.add(Network.Provider.VPCVirtualRouter);
defaultVPCOffProviders.put(Service.Dhcp, defaultProviders);
defaultVPCOffProviders.put(Service.Dns, defaultProviders);
defaultVPCOffProviders.put(Service.UserData, defaultProviders);
defaultVPCOffProviders.put(Service.NetworkACL, defaultProviders);
defaultVPCOffProviders.put(Service.Gateway, defaultProviders);
defaultVPCOffProviders.put(Service.Lb, defaultProviders);
defaultVPCOffProviders.put(Service.SourceNat, defaultProviders);
defaultVPCOffProviders.put(Service.StaticNat, defaultProviders);
defaultVPCOffProviders.put(Service.PortForwarding, defaultProviders);
defaultVPCOffProviders.put(Service.Vpn, defaultProviders);
defaultVPCOffProviders.put(Service.Firewall, defaultProviders);
final Set<Network.Provider> defaultVpcProviders = new HashSet<>();
defaultVpcProviders.add(Network.Provider.VPCVirtualRouter);
defaultVPCOffProviders.put(Service.Dhcp, defaultVpcProviders);
defaultVPCOffProviders.put(Service.Dns, defaultVpcProviders);
defaultVPCOffProviders.put(Service.UserData, defaultVpcProviders);
defaultVPCOffProviders.put(Service.NetworkACL, defaultVpcProviders);
defaultVPCOffProviders.put(Service.Gateway, defaultVpcProviders);
defaultVPCOffProviders.put(Service.Lb, defaultVpcProviders);
defaultVPCOffProviders.put(Service.SourceNat, defaultVpcProviders);
defaultVPCOffProviders.put(Service.StaticNat, defaultVpcProviders);
defaultVPCOffProviders.put(Service.PortForwarding, defaultVpcProviders);
defaultVPCOffProviders.put(Service.Vpn, defaultVpcProviders);
defaultVPCOffProviders.put(Service.Firewall, defaultVpcProviders);

Transaction.execute(new TransactionCallbackNoReturn() {
@Override
Expand Down Expand Up @@ -636,6 +636,20 @@ public void doInTransactionWithoutResult(final TransactionStatus status) {
true, false, false, false, false, null, null, null, true, null, null, false);
}

//#4-2 - default isolated offering with Source nat service and egress traffic allowed by default
if (_networkOfferingDao.findByUniqueName(NetworkOffering.DefaultIsolatedNetworkOfferingWithSourceNatServiceDefaultEgressAllowed) == null) {
offering = _configMgr.createNetworkOffering(NetworkOffering.DefaultIsolatedNetworkOfferingWithSourceNatServiceDefaultEgressAllowed,
Comment thread
weizhouapache marked this conversation as resolved.
"Offering for Isolated networks with Source Nat service enabled and egress traffic allowed by default", TrafficType.Guest, null, false, Availability.Optional, null,
defaultIsolatedSourceNatEnabledNetworkOfferingProviders, true, Network.GuestType.Isolated, false, null, true, null, false, false, null, true, null,
Comment thread
weizhouapache marked this conversation as resolved.
true, false, false, false, false, null, null, null, true, null, null, false);
// keep consistent with the offering created on fresh installation (ConfigurationServerImpl)
offering.setMulticastRateMbps(null);
offering.setDedicatedLB(true);
offering.setAssociatePublicIP(true);
offering.setSupportsVmAutoScaling(true);
_networkOfferingDao.update(offering.getId(), offering);
}

//#5 - default vpc offering with LB service
if (_networkOfferingDao.findByUniqueName(NetworkOffering.DefaultIsolatedNetworkOfferingForVpcNetworks) == null) {
offering = _configMgr.createNetworkOffering(NetworkOffering.DefaultIsolatedNetworkOfferingForVpcNetworks,
Expand Down
18 changes: 13 additions & 5 deletions engine/schema/src/main/java/com/cloud/offerings/NetworkOfferingVO.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@ public class NetworkOfferingVO implements NetworkOffering {
NetworkMode networkMode;

@Column(name = "egress_default_policy")
boolean egressdefaultpolicy;
boolean egressDefaultPolicy;

@Column(name = "concurrent_connections")
Integer concurrentConnections;
Expand Down Expand Up @@ -343,12 +343,16 @@ public void setRedundantRouter(boolean redundantRouter) {

@Override
public boolean isEgressDefaultPolicy() {
return egressdefaultpolicy;
return egressDefaultPolicy;
}

public void setEgressDefaultPolicy(boolean egressDefaultPolicy) {
this.egressDefaultPolicy = egressDefaultPolicy;
}

public NetworkOfferingVO(String name, String displayText, TrafficType trafficType, boolean systemOnly, boolean specifyVlan, Integer rateMbps,
Integer multicastRateMbps, boolean isDefault, Availability availability, String tags, Network.GuestType guestType, boolean conserveMode,
boolean specifyIpRanges, boolean isPersistent, boolean internalLb, boolean publicLb, boolean isForVpc) {
Integer multicastRateMbps, boolean isDefault, Availability availability, String tags, Network.GuestType guestType, boolean conserveMode,
boolean specifyIpRanges, boolean isPersistent, boolean internalLb, boolean publicLb, boolean isForVpc) {
this.name = name;
this.displayText = displayText;
this.rateMbps = rateMbps;
Expand Down Expand Up @@ -404,7 +408,7 @@ public NetworkOfferingVO(String name, String displayText, TrafficType trafficTyp
this.elasticLb = elasticLb;
this.inline = inline;
this.eipAssociatePublicIp = associatePublicIP;
this.egressdefaultpolicy = egressdefaultpolicy;
this.egressDefaultPolicy = egressdefaultpolicy;
this.supportsStrechedL2 = supportsStrechedL2;
this.supportsPublicAccess = supportsPublicAccess;
}
Expand Down Expand Up @@ -488,6 +492,10 @@ public boolean isAssociatePublicIP() {
return eipAssociatePublicIp;
}

public void setAssociatePublicIP(boolean associatePublicIP) {
this.eipAssociatePublicIp = associatePublicIP;
}

@Override
public boolean isElasticLb() {
return elasticLb;
Expand Down
19 changes: 18 additions & 1 deletion server/src/main/java/com/cloud/server/ConfigurationServerImpl.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1070,12 +1070,29 @@ public void doInTransactionWithoutResult(TransactionStatus status) {
defaultIsolatedSourceNatEnabledNetworkOffering.setSupportsVmAutoScaling(true);
defaultIsolatedSourceNatEnabledNetworkOffering = _networkOfferingDao.persistDefaultNetworkOffering(defaultIsolatedSourceNatEnabledNetworkOffering);

// Offering #3-2
NetworkOfferingVO defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed =
new NetworkOfferingVO(NetworkOffering.DefaultIsolatedNetworkOfferingWithSourceNatServiceDefaultEgressAllowed,
"Offering for Isolated networks with Source Nat service enabled and egress traffic allowed by default", TrafficType.Guest, false, false, null, null, true, Availability.Optional, null,
Network.GuestType.Isolated, true, false, false, false, true, false);

defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.setState(NetworkOffering.State.Enabled);
defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.setSupportsVmAutoScaling(true);
defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.setEgressDefaultPolicy(true);
defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed = _networkOfferingDao.persistDefaultNetworkOffering(defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed);
Comment on lines +1079 to +1082

for (Service service : defaultIsolatedSourceNatEnabledNetworkOfferingProviders.keySet()) {
NetworkOfferingServiceMapVO offService =
new NetworkOfferingServiceMapVO(defaultIsolatedSourceNatEnabledNetworkOffering.getId(), service,
defaultIsolatedSourceNatEnabledNetworkOfferingProviders.get(service));
_ntwkOfferingServiceMapDao.persist(offService);
logger.trace("Added service for the network offering: " + offService);
logger.trace("Added service {} for the network offering: {}", offService, defaultIsolatedSourceNatEnabledNetworkOffering.getUniqueName());

offService =
new NetworkOfferingServiceMapVO(defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.getId(), service,
defaultIsolatedSourceNatEnabledNetworkOfferingProviders.get(service));
_ntwkOfferingServiceMapDao.persist(offService);
logger.trace("Added service {} for the network offering: {}", offService, defaultIsolatedSourceNatEnabledNetworkOfferingWithDefaultEgressAllowed.getUniqueName());
}

// Offering #4
Expand Down
Loading