merge v2.6.0 master

Author: monrog2

aci-preupgrade-validation-script.py

@@ -34,7 +34,7 @@
 import os
 import re
 
-SCRIPT_VERSION = "v2.5.0"
+SCRIPT_VERSION = "v2.6.0"
 DONE = 'DONE'
 PASS = 'PASS'
 FAIL_O = 'FAIL - OUTAGE WARNING!!'
@@ -5250,6 +5250,111 @@ def ave_eol_check(index, total_checks, tversion, **kwargs):
     return result
 
 
+def stale_pcons_ra_mo_check(index, total_checks, cversion, tversion, **kwargs):
+    title = 'Stale pconsRA Objects'
+    result = PASS
+    msg = ''
+    headers = ["Stale pconsRA DN", "Non-Existing DN"]
+
+    data = []
+    recommended_action = 'Contact Cisco TAC to delete stale pconsRA before upgrading'
+    doc_url = 'https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#stale-pconsra-object'
+    print_title(title, index, total_checks)
+
+    if not tversion:
+        print_result(title, MANUAL, "Target version not supplied. Skipping.")
+        return MANUAL
+
+    if cversion.older_than("6.0(3d)") and tversion.newer_than("6.0(3c)") and tversion.older_than("6.1(4a)"):
+        pcons_rssubtreedep_api = 'pconsRsSubtreeDep.json?query-target-filter=wcard(pconsRsSubtreeDep.tDn,"/instdn-")'
+        pcons_rssubtreedep_mo = icurl('class', pcons_rssubtreedep_api)
+        pcons_inst_dn_reg = r'registry/class-\d+/instdn-\[(?P<policy_dn>.+?)\]/ra'
+        pcons_ra_dn_reg = r'(?P<pcons_ra_dn>.+?)/p...-\['
+
+        pcons_ra_set = set()
+        policy_dn_set = set()
+
+        for mo in pcons_rssubtreedep_mo:
+            pcons_rssubtreedep_tdn = mo['pconsRsSubtreeDep']['attributes']['tDn']
+            instdn_found = re.search(pcons_inst_dn_reg, pcons_rssubtreedep_tdn)
+            radn_found = re.search(pcons_ra_dn_reg, pcons_rssubtreedep_tdn)
+            if instdn_found and radn_found:
+                pcons_ra_dn = radn_found.group('pcons_ra_dn')
+                policy_dn = instdn_found.group('policy_dn')
+                if pcons_ra_dn not in pcons_ra_set:
+                    pcons_ra_set.add(pcons_ra_dn)
+                if policy_dn not in policy_dn_set:
+                    policy_dn_set.add(policy_dn)
+
+        for policy_dn in policy_dn_set:
+            policy_dn_api = policy_dn + '.json'
+            policy_dn_mo = icurl('mo', policy_dn_api)
+            if not policy_dn_mo:
+                for pcons_ra_dn in pcons_ra_set:
+                    if policy_dn in pcons_ra_dn:
+                        pcons_ra_api = pcons_ra_dn + '.json'
+                        pcons_ra_dn_mo = icurl('mo', pcons_ra_api)
+                        if pcons_ra_dn_mo:
+                            data.append([pcons_ra_dn, policy_dn])
+    else:
+        print_result(title, NA, "Target version not supplied or not applicable. Skipping.")
+        return NA
+
+    if data:
+        result = FAIL_O
+    print_result(title, result, msg, headers, data, recommended_action=recommended_action, doc_url=doc_url)
+    return result
+
+
+def isis_database_byte_check(index, total_checks, tversion, **kwargs):
+    title = 'ISIS DTEPs Byte Size'
+    result = PASS
+    msg = ''
+    headers = ["ISIS DTEPs Byte Size", "ISIS DTEPs"]
+    data = []
+    recommended_action = 'Upgrade to a version with the fix for CSCwp15375. Current target version is affected.'
+    doc_url = 'https://datacenter.github.io/ACI-Pre-Upgrade-Validation-Script/validations/#isis-dteps-byte-size'
+    print_title(title, index, total_checks)
+
+    if not tversion:
+        print_result(title, MANUAL, "Target version not supplied. Skipping.")
+        return MANUAL
+
+    if tversion.newer_than("6.1(1a)") and tversion.older_than("6.1(3g)"):
+        isisDTEp_api = 'isisDTEp.json'
+        isisDTEp_api += '?query-target-filter=eq(isisDTEp.role,"spine")'
+
+        isisDTEps = icurl('class', isisDTEp_api)
+
+        physical_ids = set()
+        proxy_acast_ids = set()
+
+        for entry in isisDTEps:
+            dtep_type = entry['isisDTEp']['attributes']['type']
+            dtep_id = entry['isisDTEp']['attributes']['id']
+
+            if dtep_type == "physical":
+                physical_ids.add(dtep_id)
+            elif "physical,proxy-acast" in dtep_type:
+                proxy_acast_ids.add(dtep_id)
+
+        for physical_id in physical_ids:
+            combined_dteps = ",".join([physical_id] + list(proxy_acast_ids))
+            total_bytes = len(combined_dteps)
+
+            if total_bytes > 57:
+                result = FAIL_O
+                data.append([total_bytes, combined_dteps])
+                break
+
+    else:
+        print_result(title, NA, "Target version not affected")
+        return NA
+
+    print_result(title, result, msg, headers, data, recommended_action=recommended_action, doc_url=doc_url)
+    return result
+
+
 # ---- Script Execution ----
 
 def parse_args(args):
@@ -5390,6 +5495,8 @@ def get_checks(is_puv, debug_func):
         n9408_model_check,
         pbr_high_scale_check,
         standby_sup_sync_check,
+        stale_pcons_ra_mo_check,
+        isis_database_byte_check,
 
     ]
     conn_checks = [

docs/docs/validations.md

@@ -184,6 +184,9 @@ Items                                           | Defect       | This Script
 [PBR High Scale][d23]                           | CSCwi66348   | :white_check_mark: | :no_entry_sign:           |:no_entry_sign:
 [Standby Sup Image Sync][d24]                   | CSCwi66348   | :white_check_mark: | :no_entry_sign:           |:no_entry_sign:
 [Observer Database Size][d25]                   | CSCvw45531   | :white_check_mark: | :no_entry_sign:           |:no_entry_sign:
+[Stale pconsRA Object][d26]                     | CSCwp22212   | :white_check_mark: | :no_entry_sign:           |:no_entry_sign:
+[ISIS DTEPs Byte Size][d27]                     | CSCwp15375   | :white_check_mark: | :no_entry_sign:           |:no_entry_sign:
+
 
 [d1]: #ep-announce-compatibility
 [d2]: #eventmgr-db-size-defect-susceptibility
@@ -210,6 +213,8 @@ Items                                           | Defect       | This Script
 [d23]: #pbr-high-scale
 [d24]: #standby-sup-image-sync
 [d25]: #observer-database-size
+[d26]: #stale-pconsra-object
+[d27]: #isis-dteps-byte-size
 
 
 ## General Check Details
@@ -2540,6 +2545,29 @@ This check logs in to each APIC, checks the contents of the `/data2/dbstats/` di
 !!! tip
     Certain high churn logging configurations have been found to grow this DB exceptionally large while on a non-fixed version. 'Contract Permit Logging' is one such configuration.
 
+### Stale pconsRA Object
+
+Due to [CSCwp22212][57], the existence of stale pconsRA objects within an ACI fabric can cause the APIC Policymanager process to crash after an upgrade to 6.0(3d) and above. This script looks for instances of stale pconsRA objects and flags them for cleanup when found. 
+
+TAC must be engaged to cleanup these objects, as they require root access.
+
+
+### ISIS DTEPs Byte Size
+
+Due to [CSCwp15375][58], running a `show` command that dumps out the ISIS Link State Database under certain conditions, such as `show isis database detail vrf all`, will result in a switch crash.
+
+As Switch Tech Support generation includes ISIS show command output, Tech Support generation will also result in a switch crash under the same conditions.
+
+The specific conditions leading to the crash are:
+
+1. The ACI software version is 6.1(1f), 6.1(2f), 6.1(2g), or 6.1(3f)
+2. For any spine; The `isisDTEp` address + `PROXY-ACAST-MAC` address + `PROXY-ACAST-V4` address + `PROXY-ACAST-V6` address equals 58 bytes or more
+
+Do not upgrade to any affected ACI software release if this check fails.
+
+!!! note
+    Nexus Dashboard Insights (NDI) integration can cause ACI tech support generation to happen automatically as part of the bug scan feature.
+
 
 [0]: https://github.com/datacenter/ACI-Pre-Upgrade-Validation-Script
 [1]: https://www.cisco.com/c/dam/en/us/td/docs/Website/datacenter/apicmatrix/index.html
@@ -2597,4 +2625,6 @@ This check logs in to each APIC, checks the contents of the `/data2/dbstats/` di
 [53]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvw45531
 [54]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt47850
 [55]: https://www.cisco.com/c/en/us/products/collateral/cloud-systems-management/application-policy-infrastructure-controller-apic/eol-apic-virtual-edge-pod-pb.html
-[56]: https://www.cisco.com/c/en/us/td/docs/dcn/whitepapers/cisco-aci-virtual-edge-migration.html
+[56]: https://www.cisco.com/c/en/us/td/docs/dcn/whitepapers/cisco-aci-virtual-edge-migration.html
+[57]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp22212
+[58]: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwp15375