Dynamic groups should fail closed if filter is invalid #4559
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes: #N/A but see also nautobot/nautobot-app-golden-config#626
What's Changed
filter
, itsmembers()
was failing open (all objects returned) instead of closed (no objects returned). This adds logic to callfilterset.is_valid()
and fail closed if the filterset is invalid.audit_dynamic_groups
command to callDynamicGroup.clean_filter()
to also flag groups with invalidfilter
values.This is important for 2.0 as many existing DGs may have filters that become invalid as a result of the upgrade and should fail closed instead of failing open.
TODO