show configuration secondary sync (T7784) compares the local and remote config trees without applying the config-sync exclusion mask (T8502). On a fully converged HA pair it therefore permanently reports the globally-excluded paths: interfaces ethernet hw-id/address/offload, i.e. both nodes' per-node identity including the peer's management address as pending differences
Expected: empty output / "no changes" on a converged pair (as encoded for the no-diff case in test_service_config-sync.py::test_show_diff_empty).
Impact: healthy pairs always look out-of-sync, drift monitoring built on this command can never converge, and the rendered commands invite manual remediation that would delete the peer's mgmt address
Fix suggestion: in get_sync_diff()/remote_compare(), mask both trees the same way the sync client does in retrieve_config() (mask_inclusive + mask_exclusive with each tree's exclusion subtree computed against itself), or annotate excluded paths instead of presenting them as syncable drift.
Steps to reproduce:
r1:
set interfaces ethernet eth1 address '10.0.2.2/24' set service https api rest set service https api keys id RV key 'RV-RV007-KEY' set service https listen-address '10.0.2.2' commit
r2:
set interfaces ethernet eth1 address '10.0.2.1/24' commit set service config-sync mode 'load' set service config-sync secondary address '10.0.2.2' set service config-sync secondary key 'RV-RV007-KEY' set service config-sync section interfaces ethernet commit
r2 — trigger the sync:
set interfaces ethernet eth1 description 'RV-RV007' commit INFO:vyos_config_sync:Config synchronization: Mode=load, Secondary=10.0.2.2
r1 — verify convergence and that the exclusion works on the real sync path:
run show configuration commands | match "interfaces ethernet eth1" set interfaces ethernet eth1 address '10.0.2.2/24' set interfaces ethernet eth1 description 'RV-RV007' set interfaces ethernet eth1 hw-id '52:54:00:01:01:00'
r2 — run the sync diff:
vyos@r2# run show configuration secondary sync commands running interfaces ethernet delete interfaces ethernet eth0 address '192.168.124.40/24' delete interfaces ethernet eth0 hw-id '52:54:00:01:00:00' delete interfaces ethernet eth1 address '10.0.2.2/24' delete interfaces ethernet eth1 hw-id '52:54:00:01:01:00' delete interfaces ethernet eth2 hw-id '52:54:00:01:02:00' delete interfaces ethernet eth3 hw-id '52:54:00:01:03:00' delete interfaces ethernet eth4 hw-id '52:54:00:01:04:00' set interfaces ethernet eth0 address '192.168.124.41/24' set interfaces ethernet eth0 hw-id '52:54:00:02:00:00' set interfaces ethernet eth1 address '10.0.2.1/24' set interfaces ethernet eth1 hw-id '52:54:00:02:01:00' set interfaces ethernet eth2 hw-id '52:54:00:02:02:00' set interfaces ethernet eth3 hw-id '52:54:00:02:03:00' set interfaces ethernet eth4 hw-id '52:54:00:02:04:00' [edit] vyos@r2#