Unable to disable/enable multiple VS pool servers/GSLB pool members when using subresource permissions

Products

• VMware Avi Load Balancer

Issue/Introduction

Customer may experience an issue when trying to disable 4 or more servers and receive the following error:

Failure: "User with subresource access does not have permission to create/modify the following fields: {'servers'}"

Environment

Affects Avi Version below 30.2.1

Cause

This issue only happens when the user is configured with restricted access for VS pool/GSLB pool subresources - Granular Role-Based Access Controls Per Field, and when there is a lot of pool members in the config object.

Error log in /var/lib/avi/log/portal-webapp.log

[2024-10-08 19:29:54,542] ERROR [error_handler.process_exception:100] ^[[31mData Exception in PUT /api/pool/#### : ^[[0m
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/django/core/handlers/base.py", line 132, in get_response
    response = wrapped_callback(request, *callback_args, **callback_kwargs)
.
.
.

  File "/opt/avi/python/lib/avi/util/pb_subresource_check.py", line 98, in pb_subresource_check
    raise PermissionError("User with subresource access does not have permission to create/modify the following fields: " + str(disallowed_fields))
avi.rest.error_list.PermissionError: User with subresource access does not have permission to create/modify the following fields: {'servers'} 

This is because in versions below 30.2.1, in python implementation of the webapp process, the diff operation on the config object is taking more time than the expected timeout value, giving incorrect results.

 

Starting from 30.2.1, the implementation has been changed to golang and the operation is much faster and the timeout value has been removed. Hence this issue will not occur in 30.2.x versions.

Resolution

Recommend customer to upgrade to the latest version on 30.2.x + patch