Netris: address review comments on static NAT, L2 and offering form

- Match the legacy static NAT rule only when it was created for the requested public IP, on both create and delete - Roll back the dedicated L2 VPC if vNet creation fails - Hide the L2 guest type for Netris in the add offering form - Add VPN to the external provider service map for Netris only - Fix the L2 offering services javadoc
nvazquez · Oct 12, 2026 · Jun 18, 2026 · Jun 24, 2026 · Jul 6, 2026 · Jul 6, 2026
commit 40e804f4cf2f513950be32bcbcafbfaedb65f15e
diff --git a/...tration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java b/...tration/src/main/java/org/apache/cloudstack/engine/orchestration/NetworkOrchestrator.java
@@ -3182,10 +3182,9 @@ private boolean hasGuestBypassVlanOverlapCheck(final boolean bypassVlanOverlapCh
     }
 
     /**
-     * Checks for L2 network offering services. Only 3 cases allowed:
+     * Checks for L2 network offering services. Only 2 cases allowed:
      * - No services
      * - UserData service only, provided by ConfigDrive
-     * - Connectivity service only, provided by Netris
      *
      * @param ntwkOff network offering
      */

diff --git a/...work-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisApiClientImpl.java b/...work-elements/netris/src/main/java/org/apache/cloudstack/service/NetrisApiClientImpl.java
@@ -396,13 +396,9 @@ public boolean deleteNatRule(DeleteNetrisNatRuleCommand cmd) {
             NatGetBody existingNatRule = netrisNatRuleExists(natRuleName);
             // Backward compatibility: rules created before the public-IP suffix was added use the legacy name
             if (existingNatRule == null && "STATICNAT".equals(cmd.getNatRuleType())) {
-                String legacyName = getLegacyStaticNatRuleName(natRuleName);
-                if (legacyName != null) {
-                    logger.debug("Static NAT rule not found with name '{}', falling back to legacy name '{}'", natRuleName, legacyName);
-                    existingNatRule = netrisNatRuleExists(legacyName);
-                    if (existingNatRule != null) {
-                        natRuleName = legacyName;
-                    }
+                existingNatRule = findLegacyStaticNatRule(natRuleName, cmd.getNatIp());
+                if (existingNatRule != null) {
+                    natRuleName = existingNatRule.getName();
                 }
             }
             boolean ruleExists = Objects.nonNull(existingNatRule);
@@ -1170,6 +1166,14 @@ private VPCListing getOrCreateL2Vpc(NetrisCommand cmd) {
         return getVpcByNameAndTenant(l2VpcName);
     }
 
+    private void rollbackL2Vpc(VPCListing l2Vpc) {
+        try {
+            deleteVpcInternal(l2Vpc);
+        } catch (Exception e) {
+            logger.error("Failed to rollback L2 VPC {} after vNet creation failure - manual cleanup may be required: {}", l2Vpc.getName(), e.getMessage());
+        }
+    }
+
     private VPCListing getVpcByNameAndTenant(String vpcName) {
         try {
             List<VPCListing> vpcListings = listVPCs();
@@ -1256,9 +1260,11 @@ public boolean createVnet(CreateNetrisVnetCommand cmd) {
         String netrisV6IpamAllocationName = null;
         String netrisV6SubnetName = null;
         boolean createdIpv6Allocation = false;
+        boolean createdL2Vpc = false;
 
         try {
             if (isL2) {
+                createdL2Vpc = getVpcByNameAndTenant(getL2VpcName(cmd, cmd.getName())) == null;
                 associatedVpc = getOrCreateL2Vpc(cmd);
                 if (associatedVpc == null) {
                     logger.error("Failed to get or create dedicated L2 VPC to create the corresponding vNet for L2 network {}", networkName);
@@ -1309,13 +1315,17 @@ public boolean createVnet(CreateNetrisVnetCommand cmd) {
                 if (!isL2) {
                     rollbackVnetResources(associatedVpc, netrisSubnetName, netrisV6SubnetName,
                             createdIpv6Allocation ? netrisV6IpamAllocationName : null, networkName);
+                } else if (createdL2Vpc) {
+                    rollbackL2Vpc(associatedVpc);
                 }
                 return false;
             }
         } catch (Exception e) {
             if (!isL2 && associatedVpc != null) {
                 rollbackVnetResources(associatedVpc, netrisSubnetName, netrisV6SubnetName,
                         createdIpv6Allocation ? netrisV6IpamAllocationName : null, networkName);
+            } else if (isL2 && createdL2Vpc && associatedVpc != null) {
+                rollbackL2Vpc(associatedVpc);
             }
             throw new CloudRuntimeException(String.format("Failed to create Netris vNet %s", networkName), e);
         }
@@ -1710,9 +1720,9 @@ public boolean createStaticNatRule(CreateOrUpdateNetrisNatCommand cmd) {
                 return true;
             }
             // Backward compatibility: rule with legacy naming convention (no public IP post-fixed) exists - don't create a duplicate
-            String legacyName = getLegacyStaticNatRuleName(staticNatRuleName);
-            if (legacyName != null && netrisNatRuleExists(legacyName) != null) {
-                logger.debug("Legacy static NAT rule '{}' already exists on Netris, skipping creation of '{}'", legacyName, staticNatRuleName);
+            NatGetBody legacyRule = findLegacyStaticNatRule(staticNatRuleName, cmd.getNatIp());
+            if (legacyRule != null) {
+                logger.debug("Legacy static NAT rule '{}' already exists on Netris, skipping creation of '{}'", legacyRule.getName(), staticNatRuleName);
                 return true;
             }
             // Create a /32 subnet for the DNAT IP
@@ -2194,6 +2204,21 @@ private String getLegacyStaticNatRuleName(String newName) {
         return newName.substring(0, idx + "-STATICNAT".length());
     }
 
+    /**
+     * Returns the legacy-named static NAT rule only if it was created for the given public IP.
+     */
+    private NatGetBody findLegacyStaticNatRule(String newName, String natIp) {
+        String legacyName = getLegacyStaticNatRuleName(newName);
+        if (legacyName == null) {
+            return null;
+        }
+        NatGetBody legacyRule = netrisNatRuleExists(legacyName);
+        if (legacyRule == null || !(natIp + "/32").equals(legacyRule.getDestinationAddress())) {
+            return null;
+        }
+        return legacyRule;
+    }
+
     private VPCListing getNetrisVpcResource(String netrisVpcName) {
         VPCListing vpcResource = getVpcByNameAndTenant(netrisVpcName);
         if (vpcResource == null) {

diff --git a/ui/src/views/offering/AddNetworkOffering.vue b/ui/src/views/offering/AddNetworkOffering.vue
@@ -60,7 +60,7 @@
             <a-radio-button value="isolated">
               {{ $t('label.isolated') }}
             </a-radio-button>
-            <a-radio-button value="l2" v-if="form.provider !== 'NSX'">
+            <a-radio-button value="l2" v-if="form.provider !== 'NSX' && form.provider !== 'Netris'">
               {{ $t('label.l2') }}
             </a-radio-button>
             <a-radio-button value="shared" v-if="form.provider !== 'NSX' && form.provider !== 'Netris'">
@@ -1021,7 +1021,7 @@ export default {
         SourceNat: externalProvider,
         StaticNat: externalProvider,
         PortForwarding: externalProvider,
-        Vpn: this.forVpc ? this.VPCVR : this.VR,
+        ...(!isNsxProvider && { Vpn: this.forVpc ? this.VPCVR : this.VR }),
         ...((!isNsxProvider || this.form.nsxsupportlb) && { Lb: externalProvider })
       }