OVS agent: Correct bridge setup ordering

This patch fixes three issues that combined to break tunnel networks.

The first issue was the the failure mode was being set on the
integration bridge after the canary flow was installed. This
immediately wiped out the canary flow.

The second problem was that the main loop would sync tunnel networks
right before resetting the tunnel bridge when the canary flow was
missing. This meant that it would sync all of the tunnels via RPC and
then wipe them out.

The final issue was that after resetting the tunnel bridge in the
main loop, the tunnel_sync variable was not set to True, so the
tunnels would never be resynchronized.

This patch addresses the three issues in the following ways:
1. Set the failure mode on the bridge before the canary flow is
installed.
2. Run the OVS restart logic before the tunnel synchronization.
3. If the restart logic is triggered, set tunnel_sync to True to
trigger synchronization.

Closes-Bug: #1292105
Change-Id: I6381e3fee49910127c420dd2e3205c64cdb9e185

diff --git a/neutron/plugins/openvswitch/agent/ovs_neutron_agent.py b/neutron/plugins/openvswitch/agent/ovs_neutron_agent.py
index 085147a72b70b921a9558286b64d752591c4ffe4..a84c212d0ad326bfb109a20062287ebcb6fbf477 100644 (file)
--- a/neutron/plugins/openvswitch/agent/ovs_neutron_agent.py
+++ b/neutron/plugins/openvswitch/agent/ovs_neutron_agent.py
@@ -179,7 +179,6 @@ class OVSNeutronAgent(n_rpc.RpcCallback,
 
         self.int_br = ovs_lib.OVSBridge(integ_br, self.root_helper)
         self.setup_integration_br()
-        self.int_br.set_secure_mode()
         # Stores port update notifications for processing in main rpc loop
         self.updated_ports = set()
         self.setup_rpc()
@@ -728,6 +727,7 @@ class OVSNeutronAgent(n_rpc.RpcCallback,
         #   ovs-vsctl -- --may-exist add-br BRIDGE_NAME
         # which does nothing if bridge already exists.
         self.int_br.create()
+        self.int_br.set_secure_mode()
 
         self.int_br.delete_port(cfg.CONF.OVS.int_peer_patch_port)
         self.int_br.remove_all_flows()
@@ -1334,6 +1334,13 @@ class OVSNeutronAgent(n_rpc.RpcCallback,
                 ancillary_ports.clear()
                 sync = False
                 polling_manager.force_polling()
+            ovs_restarted = self.check_ovs_restart()
+            if ovs_restarted:
+                self.setup_integration_br()
+                self.setup_physical_bridges(self.bridge_mappings)
+                if self.enable_tunneling:
+                    self.setup_tunnel_br()
+                    tunnel_sync = True
             # Notify the plugin of tunnel IP
             if self.enable_tunneling and tunnel_sync:
                 LOG.info(_("Agent tunnel out of sync with plugin!"))
@@ -1342,12 +1349,6 @@ class OVSNeutronAgent(n_rpc.RpcCallback,
                 except Exception:
                     LOG.exception(_("Error while synchronizing tunnels"))
                     tunnel_sync = True
-            ovs_restarted = self.check_ovs_restart()
-            if ovs_restarted:
-                self.setup_integration_br()
-                self.setup_physical_bridges(self.bridge_mappings)
-                if self.enable_tunneling:
-                    self.setup_tunnel_br()
             if self._agent_has_updates(polling_manager) or ovs_restarted:
                 try:
                     LOG.debug(_("Agent rpc_loop - iteration:%(iter_num)d - "

diff --git a/neutron/tests/unit/openvswitch/test_ovs_tunnel.py b/neutron/tests/unit/openvswitch/test_ovs_tunnel.py
index 5719eec789792b107a32ef97088d777b0a658404..d246ff96fd20faa0050a54c88d9eacd0432d3023 100644 (file)
--- a/neutron/tests/unit/openvswitch/test_ovs_tunnel.py
+++ b/neutron/tests/unit/openvswitch/test_ovs_tunnel.py
@@ -107,12 +107,12 @@ class TunnelTest(base.BaseTestCase):
         self.mock_int_bridge = self.ovs_bridges[self.INT_BRIDGE]
         self.mock_int_bridge_expected = [
             mock.call.create(),
+            mock.call.set_secure_mode(),
             mock.call.delete_port('patch-tun'),
             mock.call.remove_all_flows(),
             mock.call.add_flow(priority=1, actions='normal'),
             mock.call.add_flow(priority=0, table=constants.CANARY_TABLE,
                                actions='drop'),
-            mock.call.set_secure_mode(),
         ]
 
         self.mock_map_tun_bridge = self.ovs_bridges[self.MAP_TUN_BRIDGE]