Limitations

Limitations

GreenNode server behaviors this SDK cannot change, each with what the SDK does about it. Most of these come from Network and Network ACLs; the rest are collected at the bottom, each with a link to where it is documented in full.

A network ACL's busy window

Associating or disassociating a subnet leaves the ACL busy for about 20 seconds, during which any other write to it fails. Unlike after a rules write, Status stays "ACTIVE" the whole time, so nothing in a read marks the window; the write itself gets a 400 naming the ACL "is being updated". The SDK maps that to network.ErrBusy, which always means nothing changed, so waiting a few seconds and calling again is safe. DeleteNetworkACL sent into that same window instead answers 500 and changes nothing; see Get, create, and delete. See also Rules.

Deleting a subnet right after disassociating it from a network ACL can also land in this window; wait about 30 seconds first. The SDK cannot see the window, and whether a delete inside it wedges the ACL is not confirmed.

Deleting a subnet a network ACL still holds

Deleting a subnet while a network ACL still lists it, instead of disassociating it first, leaves that ACL permanently stuck: every later write to it fails, its own delete fails too, and its VPC can never be deleted. DeleteSubnet refuses, sending nothing, whenever a network ACL in the subnet's VPC still holds it; disassociate the subnet first. See Creating, renaming, and deleting subnets.

A permanently stuck network ACL

Once a network ACL is wedged this way, no SDK call can recover it: every write returns 400 "is being updated", and DeleteNetworkACL returns 500. Only GreenNode support can clear it.

A VPC's zone is ignored

CreateVPC sends no zoneId; the server places every new VPC in the region's first zone regardless of what a caller asks for, confirmed through both the SDK and the GreenNode web console. The zone that matters is the one a subnet names. See Creating, renaming, and deleting VPCs.

VPC CIDRs cannot overlap

CreateVPC refuses a CIDR that overlaps any VPC already in the project, with 400 "VPC is overlap with another." The SDK does not check for an overlap itself; that check stays on the server. See Creating, renaming, and deleting VPCs.

Subnet size limits

The GreenNode web console's own subnet form offers /16, /18, /20, /22, /24, /26, and /28. The SDK does not restrict CIDR beyond requiring no host bits; the server enforces any narrower limit.

A deleted subnet lingers

GetSubnet keeps returning a deleted subnet with status "DELETED" for minutes after ListSubnetsByVPC has already dropped it, and a VPC delete can keep failing for that same stretch after its last subnet is gone. DeleteSubnet and DeleteVPC both treat this as expected and safe to retry. See Waits.

Reading a deleted network ACL

GetNetworkACL answers 500, not 404, once an ACL is deleted. This SDK never treats a bare 5xx as not-found on its own; see Get, create, and delete.

A rules replace can drop a rule silently

Sending an ACL's rules list without one of its priority-0 pass-all rules removes that rule; the same omission for a priority-2000 deny-all rule leaves it in place instead. AddNetworkACLRule and RemoveNetworkACLRule always resend every rule they read, so a caller never triggers this by accident. See Rules.

Other server quirks

• vDNS: a record write locks its zone for several seconds; any other record write started in that window fails, so the SDK waits for the zone to clear before sending one. UpdateRecord's PUT also replaces only the fields it is given, not the whole record. See Creating, updating, and deleting records.
• Security groups: the Name filter on ListSecurityGroups matches by substring, not exactly; a search for "web" also finds "webhook". See Reading groups and rules.
• SSH keys: ImportSSHKey accepts RSA public keys only; an ED25519 or ECDSA key is refused. See SSH keys.
• Container registry: a Repository has no status field, since no response carries one, and repository and user names follow their own rules the server enforces. See design/vcr-writes.md.
• IAM: a policy's or group's root field carries the account's own numeric id, sent as a JSON number rather than a string; and every list (iam-users, service-accounts, policies) numbers its pages from 0, so page 1 of a one-item list comes back empty. See design/iam-writes-api.md.
• vMonitor: pause and resume share one toggle call, so the SDK never retries either after an unconfirmed result; a retry could undo it. See Pausing and resuming.