dcnm_vrf: TOP_DOWN_VRF_VLAN resources are leaked

[allenrobel]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment

dcnm_vrf is leaking the following resource: TOP_DOWN_VRF_VLAN when a VRF is created and then deleted.

This appears to happen ONLY when the fabric contains switches to which the created VRF was NOT attached.

For example, it the attached playbook is run, and if the ONLY switch in the fabric is 10.1.1.2, the issue is not seen.

If we add a second switch, say 10.1.1.3, which is not in the playbook's attach list, and then run the playbook, a TOP_DOWN_VRF_VLAN resource associated with switch 10.1.1.3 remains after the VRF is deleted.

Adding a sleep in the playbook, and then monitoring in the NDFC GUI, the stale resource is created during the VRF deleted task.

Ansible Version and collection version

(.venv) AROBEL-M-G793% ansible --version
ansible [core 2.17.5]
  config file = /Users/arobel/.ansible.cfg
  configured module search path = ['/Users/arobel/repos/ansible/plugins/modules', '/usr/share/ansible/plugins/modules']
  ansible python module location = /Users/arobel/repos/ndfc-python/.venv/lib/python3.12/site-packages/ansible
  ansible collection location = /Users/arobel/repos/ansible/collections
  executable location = /Users/arobel/repos/ndfc-python/.venv/bin/ansible
  python version = 3.12.4 (main, Jun  6 2024, 18:26:44) [Clang 15.0.0 (clang-1500.3.9.4)] (/Users/arobel/repos/ndfc-python/.venv/bin/python)
  jinja version = 3.1.4
  libyaml = True
(.venv) AROBEL-M-G793%

DCNM version

• V x3.6.0

ND/NDFC version

3.2.1e / 12.2.2.238

Affected module(s)

• dcnm_vrf

Ansible Playbook

- name: Minimum reproduce for TOP_DOWN_VRF_VLAN resource leak
  hosts: ndfc
  vars:
    FABRIC_NAME: FABRIC_1
    VRF_NAME: VRF_1
    SWITCH_IP4: 10.1.1.2
    ATTACH_PORTS: ["Ethernet1/9"]

  tasks:
    - name: Merge VRF
      cisco.dcnm.dcnm_vrf:
        fabric: "{{ FABRIC_NAME }}"
        state: merged
        config:
        - vrf_name: "{{ VRF_NAME }}"
          vrf_id: 50101 
          adv_default_routes: off
          static_default_route: false
          vrf_template: Default_VRF_Universal
          vrf_extension_template: Default_VRF_Extension_Universal
          vlan_id: 201
          vrf_int_mtu: 9000
          attach:
          - ip_address: "{{ SWITCH_IP4 }}"
            deploy: on
      register: result

    - name: Sleep 60 seconds
      ansible.builtin.pause:
        seconds: 60

    - name: Delete VRF
      cisco.dcnm.dcnm_vrf:
        fabric: '{{ FABRIC_NAME }}'
        state: deleted
        config:
        - vrf_name: "{{ VRF_NAME }}"

Debug Output

Expected Behavior

When deleting a VRF, all associated resources should be released.

Actual Behavior

When deleting a VRF, a TOP_DOWN_VRF_VLAN resource (one per VRF per switch X present in the fabric -- where switch X is NOT in the attach list for the VRF merged task) remains after the VRF is deleted. In the NDFC GUI, these resources are displayed as being Allocated to its associated (and now deleted) VRF (Fabric Detail -> Resources, filter on Resource Type == TOP_DOWN_VRF_VLAN).

Steps to Reproduce

Run the attached playbook with two or more switches in the fabric. A TOP_DOWN_VRF_VLAN resource will remain for every switch in the fabric that is not in the playbook's attach list.

References