Skip to content

Release 9.1.1 - #646

Merged
al1img merged 109 commits into
mainfrom
develop
Aug 18, 2026
Merged

Release 9.1.1#646
al1img merged 109 commits into
mainfrom
develop

Conversation

@al1img

@al1img al1img commented Aug 18, 2026

Copy link
Copy Markdown
Collaborator

No description provided.

mykola-kobets-epam and others added 30 commits August 18, 2026 16:01
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
When multiple update items are installed at same time, removing orphans function
that called at the end of update item install can remove already partially
installed blobs from other items that leads to undefined behaviour. The fix
is to perform removing orphans in dedicated thread after all items are
processed.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
ResizeSpace called Partition::Free + Partition::Allocate which toggled
mAllocationCount on every resize. Since mAllocationCount > 0 suppresses
disk re-reads, mAvailableSize became stale and lazy eviction stopped
triggering, leading to ENOSPC on subsequent allocations.

Add Partition::AdjustSize that adjusts mAvailableSize and triggers
eviction when needed without touching mAllocationCount. ResizeSpace now
calls AdjustSize instead of the Free/Allocate pair on the partition,
keeping mAllocationCount as a pure count of live Space objects.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
…llation

When a download is cancelled to process a new desired status, mCancel is
set to true. Once the cancelled download finishes and mInProgress becomes
false, a subsequent DownloadUpdateItems call would enter StartAction and
immediately return false because mCancel was still set, causing the new
download to fail with eCanceled without attempting any network activity.

Only reject starting a new action when mCancel is true and mInProgress is
also true, meaning there is an active download being cancelled. A stale
mCancel with no in-progress action should not block the next download.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Checking mInProgressBlobs.IsEmpty is not necessary as when mNumActiveInstalls is
zero then mInProgressBlobs is empty.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Move install service layers to InstallServiceLayers and install component
layers to  InstallComponentLayers to reduce size of InstallUpdateItem function.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Replace the mNumActiveInstalls counter and flat mInProgressBlobs list with
per-item InstallItem structs that record which blobs and layers each concurrent
install owns. Feed those into RemoveOrphans via AddInstallingItems so that blobs
actively being downloaded are treated as used and not deleted as orphans.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
…cessed"

This reverts commit 468fee5.

Introducing installing items handling resolve this issue as well. So this fix
is not required anymore.

Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
RemoveOutdatedItems test items had empty manifest digests, causing
CalcItemBlobsAndLayers to fail with eInvalidArgument when RemoveOrphans
called CreateBlobPath on them. Provide valid sha256 digests and add a
LoadImageManifest mock returning a valid manifest to fix the error.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Verify that blobs being downloaded by an active install are not deleted
as orphans when RemoveOrphans runs concurrently via RemoveItem. The test
blocks the downloader after the manifest file is created, triggers
RemoveItem through ItemRemoverItf, and asserts the file survives before
allowing the install to complete.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
The `releaseInstalling` RAII guard was scoped inside the
`if (waitInstalling)` block, causing `ReleaseInstallingBlob` to fire
immediately on block exit rather than at function return. Move the guard
to function scope and add the `waitInstalling` check inside the lambda
to preserve conditional behavior.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Add mSubnet to InstanceFirewallParams and populate it from the instance
network allocation. This lets the service manager firewall recognise the
instance's own network (subnet) and allow unrestricted communication
between instances that share it, while still filtering cross-network
traffic.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Replace per-item StaticArray<UnitInstanceStatus, N> with a flat
StaticArray<UnitInstanceStatus*, cMaxNumInstances> in
UnitInstancesStatuses, backed by mUnitInstancesStatuses owned by
UnitStatusHandler. This removes the per-item instance limit and avoids
large inline storage inside each UnitInstancesStatuses entry.

Remove cMaxNumUpdateItemInstances constant as it is no longer needed.

Update UnitInstancesStatuses::operator== to dereference pointers for
deep value comparison. Update tests accordingly.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
On destruction iterate mPhysicalNetworks (the networks whose bridge was
actually created) instead of every persisted provider, and treat eNotFound
from DeleteLink as success in ClearNetwork. This stops the spurious
"Can't clear network: err=link not found" error on systemctl restart
aos.target, where the destructor tried to delete bridges that were never
created this session or already removed when the last instance left.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Add a master parameter to InterfaceFactoryItf::CreateVlan so the vlan is
enslaved to the bridge via IFLA_MASTER in the same RTM_NEWLINK message.
CreateNetwork no longer issues a separate SetMasterLink, saving a netlink
round-trip on network creation.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Mykola Solianko and others added 23 commits August 18, 2026 16:38
FlushBatch commits the firewall, traffic-monitor and storage backends in
sequence and gives each failure its own recovery so a partial batch never
leaves one backend applied while another is not: a firewall-flush failure
aborts the still-staged traffic batch, a traffic-flush failure reverts the
already-flushed firewall, and a storage-commit failure reverts both. The
storage transaction is rolled back on every failure path, and the batch
entries are re-applied per instance so one bad instance is isolated
instead of failing the whole flush.

Cover the firewall-, traffic- and commit-failure paths with tests.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
ReconcileInstances registered the network DNS server (AdoptDNSServer) only
on the leftover-cleanup path, not for instances adopted as running via
InitInstance. DeleteInstanceNetworkConfig then could not find the DNS
server ("DNS server not found for cleanup") and left stale addnhosts
entries when such an instance was later removed.

Adopt the DNS server before continuing the running-instance branch too.
AdoptDNSServer is idempotent, so multiple instances on one network are
safe; a failure is logged and does not abort adoption.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Adopt a running leftover instance on restart, assert the network DNS
server is registered (CreateServer), and that a subsequent
StopInstanceNetwork drops the instance host entry (RemoveHost). Without
the reconcile fix neither call happens, so the test fails.

Update Start_KeepsLeftoverInstanceWithLiveInterface to expect the DNS
server adoption too.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Signed-off-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
MakeUnique/MakeShared placement-constructed objects via the
Allocator-based operator new, which only guarded a failed
allocation with assert(). In release builds (NDEBUG) that assert
is compiled out, so an exhausted allocator returned nullptr and
the constructor still ran at a null address (UB).

Both factories now call Allocator::Allocate() explicitly, check
the result, and return an empty pointer instead of constructing
when the allocation fails.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
MakeUnique/MakeShared already returned an empty (falsy) pointer on
allocator exhaustion, but most call sites across the codebase never
checked the result before dereferencing it, so an out-of-memory
condition would still crash on a null-pointer dereference instead of
being reported as an error.

Add a check after every such call site, propagating eNoMemory using
whichever convention the enclosing function already uses (Error,
RetWithError<X>, bool, or void with a log message).

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Rework the memory allocation abstraction in memory.hpp:

- Rename Allocator to AllocatorItf, keeping only Allocate/Free and a
  virtual destructor. This decouples callers from any particular
  allocation strategy.
- Remove StaticAllocator, BufferAllocator and the custom placement
  new/delete operator overloads (allocator.hpp is deleted). Sizing a
  static arena correctly, especially for multithreaded usage, was
  error prone and required extra bookkeeping.
- Add HeapAllocator (malloc/free backed) for Linux and test usage.
  Safety-critical targets can provide their own AllocatorItf
  implementation.
- Rework SharedPtr to use intrusive control blocks
  (SharedControlBlock/SharedObjectControlBlock/SharedAdoptControlBlock)
  instead of allocator-external ref-counting, so it works uniformly
  over any AllocatorItf implementation.
- MakeUnique/MakeShared now check the allocation result before
  constructing the object, returning a null pointer on failure instead
  of relying on assert(), which is stripped in release builds.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Convert common/ classes that previously owned a private static
allocator to receive an AllocatorItf reference/pointer instead,
following the two-phase construct-then-Init() pattern used across the
codebase (allocator as the first Init()/constructor parameter):

- crypto: CertLoader, CryptoHelper, mbedtls/openssl CryptoProviderItf
  implementations, pkcs11::Utils, PKCS11RSAPrivateKey.
- pkcs11: LibraryContext, PKCS11Manager.
- monitoring: Average, Monitoring.
- spaceallocator: SpaceAllocator; also renamed its own "space"
  allocator members (OutdatedItem::mSpaceAllocator, the nested Space
  class's mSpaceAllocator) to avoid confusion with the new memory
  AllocatorItf member.
- fs: CalculateSize takes an AllocatorItf parameter (first), and
  FileInfoProvider forwards it internally; dropped the shared static
  allocator and its guarding mutex, since callers now own their
  allocator's thread-safety.

Multiple per-class named allocators are consolidated into a single
AllocatorItf pointer where heap allocation removes the need for
separate statically-sized pools.

Unit tests construct a HeapAllocator and pass it in, always declared
before any member that may allocate from it, since C++ destroys
members in reverse declaration order.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Convert cm/ classes that previously owned a private static allocator
to receive an AllocatorItf reference/pointer instead, following the
two-phase construct-then-Init() pattern used across the codebase
(allocator as the first Init() parameter, or constructor parameter for
Instance/ComponentInstance/ServiceInstance which have no Init()):

- alerts, imagemanager, nodeinfoprovider, storagestate, unitconfig,
  updatemanager (desiredstatushandler, unitstatushandler,
  updatemanager).
- launcher: Launcher composition root and all of its composed
  sub-components (InstanceManager, ImageInfoProvider, StorageState,
  NodeManager, Node, Balancer, RunRequestsLoader), forwarding the same
  allocator instance through the whole ownership chain.

Multiple per-class named allocators are consolidated into a single
AllocatorItf pointer where heap allocation removes the need for
separate statically-sized pools.

Unit tests construct a HeapAllocator and pass it in, always declared
before any member that may allocate from it, since C++ destroys
members in reverse declaration order.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Convert iam/ classes that previously owned a private static allocator
to receive an AllocatorItf reference/pointer instead, following the
two-phase construct-then-Init() pattern used across the codebase
(allocator as the first Init() parameter):

- nodemanager: NodeManager.
- certhandler: CertModule, PKCS11Module (consolidating its separate
  temp-object and local-cache allocators into a single AllocatorItf
  pointer). CertHandler has no Init(), so the allocator is passed
  through its constructor instead.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Convert sm/ classes that previously owned a private static allocator
to receive an AllocatorItf reference/pointer instead, following the
two-phase construct-then-Init() pattern used across the codebase
(allocator as the first Init() parameter):

- imagemanager: ImageManager.
- launcher: Launcher.
- networkmanager: NetworkManager (consolidating its separate
  network-info and resolv-hosts allocators into a single
  AllocatorItf pointer).
- nodeconfig: NodeConfig.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
The map is keyed by instance ID only, so its capacity should be
cMaxNumInstances rather than cMaxNumInstances * cMaxNumOwners, which
oversized the allocation. Realign member declarations accordingly.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Remove unmatched suppression: templateRecursion from array.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
UpdateInstances() left mLaunchInProgress stuck true if StartLaunch()
succeeded but the subsequent stop/start array allocation failed,
since the early return skipped FinishLaunch(). Guard it with a
DeferRelease that calls FinishLaunch() whenever the function exits
with a non-none error, leaving the async thread responsible for
FinishLaunch() on the success path.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
cppcheck flags mAllocator as an unused struct member since it is
only ever referenced implicitly (as the source allocator passed to
other members) rather than accessed directly.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
The AllocatorItf redesign dropped the mutex that previously guarded
the shared pointer allocation's reference count inside the old
Allocator class, leaving SharedControlBlock::Take/Give to increment
and decrement a plain size_t with no synchronization. Concurrent
copies/resets of a SharedPtr from multiple threads could therefore
race on the ref count.

Add a Mutex to SharedControlBlock guarding Take/Give, restoring the
previous thread safety guarantee. Give() releases the lock before
calling Dispose(), since disposal destroys the control block (and
its mutex) itself.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
LibraryContext::PKCS11OpenSession opened a PKCS11 session but did not
close it if allocating the SessionContext wrapper failed, leaking the
underlying session handle.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
PrepareDownloadSpace freed the space taken by a partially downloaded
blob and then allocated the full blob size, reserving the partial size
twice and briefly offering space still occupied on disk to other
allocators sharing the partition. Reserve only the bytes still to be
written and, on cancel, return the reserved but not written part
instead of reallocating the difference, which underflowed when the
downloader restarted the file.

Keep the reservation in DownloadSpace, settle it in a single place so
the download file is removed before its space is freed, and guard
EnsureBlob against paths leaving the space neither accepted nor
released. Drop AllocateSpaceForPartialDownloads: the allocator already
accounts files present on disk.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
CM kept every removed item version in storage until updateItemTTL
expired (30d by default), while all read buffers were sized against
cMaxNumItemVersions (2). On the third consecutive update of the same
item GetItemInfos() overflowed its array and the launcher failed with
"can't add item info", leaving the instance unable to start.

Trim the oldest removed versions before adding a new one, the way SM
does it in RemoveOldItemVersions(), so an item never exceeds
cMaxNumItemVersions rows. An installed version is never force removed:
if no removed version is left to reclaim, the trim just stops.

Add cMaxNumStoredItems to size the buffers holding the whole table:
GetAllItemsInfos() ones counted items instead of rows and would have
overflowed the same way past 64 rows.

Signed-off-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Increased memory footprint:
sm/iam - none
cm - 16KB

Signed-off-by: Mykola Kobets <mykola_kobets@epam.com>
Reviewed-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Add [profiling] tagged info-level log markers around key stages of
the desired status processing (download, install, launch, wait
active, finalize) and instance preparation/deployable items install
in the launcher, to help measure timing during load testing.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>
Two preinstalled boot and rootfs instances are reserved per node,
consuming 4 instance slots across two nodes. Bump the limit from
256 to 260 so that 256 instances can still be installed on top of
the preinstalled ones.

Signed-off-by: Oleksandr Grytsov <oleksandr_grytsov@epam.com>
Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>
Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>

@mlohvynenko mlohvynenko left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed-by: Mykhailo Lohvynenko <mykhailo_lohvynenko@epam.com>

@codecov

codecov Bot commented Aug 18, 2026

Copy link
Copy Markdown

Codecov Report

❌ Patch coverage is 82.37646% with 617 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@b4df65d). Learn more about missing BASE report.

Files with missing lines Patch % Lines
src/core/sm/networkmanager/networkmanager.cpp 69.17% 131 Missing ⚠️
src/core/sm/launcher/launcher.cpp 67.30% 119 Missing ⚠️
src/core/cm/launcher/instancemanager.cpp 50.00% 46 Missing ⚠️
src/core/sm/imagemanager/imagemanager.cpp 81.30% 23 Missing ⚠️
src/core/common/pkcs11/pkcs11.cpp 58.49% 22 Missing ⚠️
...core/iam/certhandler/certmodules/pkcs11/pkcs11.cpp 58.13% 18 Missing ⚠️
src/core/cm/imagemanager/imagemanager.cpp 85.95% 17 Missing ⚠️
src/core/cm/launcher/overrideenvvarsprocessor.cpp 81.81% 16 Missing ⚠️
src/core/common/crypto/cryptohelper.cpp 68.08% 15 Missing ⚠️
src/core/cm/launcher/instance.cpp 75.00% 14 Missing ⚠️
... and 39 more
Additional details and impacted files
@@           Coverage Diff           @@
##             main     #646   +/-   ##
=======================================
  Coverage        ?   84.60%           
=======================================
  Files           ?      329           
  Lines           ?    30897           
  Branches        ?     4238           
=======================================
  Hits            ?    26141           
  Misses          ?     4756           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@sonarqubecloud

Copy link
Copy Markdown

Quality Gate Failed Quality Gate failed

Failed conditions
39.2% Coverage on New Code (required ≥ 80%)
E Reliability Rating on New Code (required ≥ A)
C Security Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

@MykolaSuperman MykolaSuperman left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed-by: Mykola Solianko <mykola_solianko@epam.com>

@mykola-kobets-epam mykola-kobets-epam left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Reviewed-by: Mykola Kobets <mykola_kobets@epam.com>

@al1img
al1img merged commit 5257243 into main Aug 18, 2026
18 of 19 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Development

Successfully merging this pull request may close these issues.

4 participants