fix(neutron): refactor palo_alto to move pure functions out of class PUC-2095

[nidzrai]

What does this change do?

palo_alto_wiring.py is mostly the wiring methods moved out of palo_alto.py. While moving them I changed them to take router_id instead of the router dict (they only ever read the id), and gave the class a small public API: ensure_stack, attach_port, cleanup_attachment, snapshot_attachment / undo_attachment and check_can_attach.
The tests follow the same split. The wiring tests now build PaloAltoWiring from small fixtures .

• Gateway attach rolls back on failure. Neutron commits the gateway port before ROUTER_GATEWAY/AFTER_CREATE and does not undo it when we raise. A failure halfway used to leave the anchor parent port, its VIF on an appliance NIC and sometimes the trunk behind, and running router set --external-gateway again did nothing. The handler now snapshots the router's wiring first and undoes only what this request added, using the same snapshot/undo as the interface path.

• No false success on transient DB errors. Neutron's callback manager turns a retriable error into a RetryRequest. update_router then retries, finds the gateway already created, skips the event and returns 200 for a gateway that is not wired. These errors now come back as PaloAltoGatewayWiringFailed (409), including when an inner retry decorator has already given up.

• Pre-check before the gateway is created. A read-only check on ROUTER_GATEWAY/BEFORE_CREATE rejects a Palo Alto router with no adopted node, or whose node has no port with both physical_network and local_link_connection (PaloAltoNodeHasNoUsablePort, 400). Neutron has not created anything yet at that point, so the same command works once the node is fixed.

• Inline BadRequests are now named exceptions. Their messages no longer start with "Bad router request:".

• Wiring log lines now come from the neutron_understack.l3_router.palo_alto_wiring logger.

• These methods don't use self except to get their inputs , so moving out these pure functions to module level

• Added named exception

• One router-lookup helper

• redundant _has_subport , removed dead _remove_gateway_subport

• change _ensure_parent_vif_attached a single exit path (Fetch the port, check Ironic annotated it, return it" lived in both the helper and the main function) , _confirm_parent_vif_attach_after_error returned dict but ideally it should be bool .

• Refactor _InterfaceAttachment checks, moved th check out of handler

• TODO Dev testing:

  • Set and unset the gateway on a Palo Alto router.
  • Set the gateway on a node whose port has no physical_network: 400, no anchor parent port created, and the same command works after fixing the port.
  • Check the pre-check timing in the neutron-server DEBUG log.

• [TODO ] Not in this PR

• The wiring reconciler (neutron: preserve Palo Alto wiring when interface port deletion fails #2328, neutron: roll back Palo Alto interface wiring after post-create failures #2329).

• Lookups can still create the anchor network when it is missing.

• resource_class is read from every service profile on the flavor, not only the one that selected the driver.

• Two concurrent attaches on one router can create duplicate parent ports and trunks.

Upgrade impact

• This change requires operator action to upgrade. If checked, add the
  upgrade-impact label and a release note: run scriv create from the
  repository root and describe the required action in the generated
  changelog.d/ file. See RELEASING.md.

Operator action means anything a deployment has to do beyond a normal resync:
deploy repo or values changes, new or removed secrets, enabling or disabling a
component, or a manual one-time step.

[github-actions]

Python test results

129 tests   129 ✅  6s ⏱️
  1 suites    0 💤
  1 files      0 ❌

Results for commit 09d8abe.

♻️ This comment has been updated with latest results.