Check missed IPSet utility using neutron-sanity-check

In some case, host may lack ipset utility (e.g., due to a
dependency issue)

This patch allows checking IPSet utility support from CLI:
    neutron-sanity-check --ipset_installed

Or using configuration options, for example:
    neutron-sanity-check --config-file /etc/neutron/neutron.conf
    --config-file /etc/neutron/plugins/ml2/ml2_conf.ini

Closes-Bug: #1510680
Change-Id: I2b9d6b13087a970bb0919a8217e428ce60d6e0c3

diff --git a/neutron/cmd/sanity/checks.py b/neutron/cmd/sanity/checks.py
index 761be3c065949028cef54a8f0aa256c0db66190c..2f46f44629fb968a23457b2f42cadc90d3b42b76 100644 (file)
--- a/neutron/cmd/sanity/checks.py
+++ b/neutron/cmd/sanity/checks.py
@@ -343,6 +343,17 @@ def ebtables_supported():
         return False
 
 
+def ipset_supported():
+    try:
+        cmd = ['ipset', '--version']
+        agent_utils.execute(cmd)
+        return True
+    except (OSError, RuntimeError, IndexError, ValueError) as e:
+        LOG.debug("Exception while checking for installed ipset. "
+                  "Exception: %s", e)
+        return False
+
+
 def get_minimal_dibbler_version_supported():
     return MINIMUM_DIBBLER_VERSION
 

diff --git a/neutron/cmd/sanity_check.py b/neutron/cmd/sanity_check.py
index c063481f73cec7ac522037bbf9d456de179250d1..71a286d9a5c93376b67bfd155ed13e501034a552 100644 (file)
--- a/neutron/cmd/sanity_check.py
+++ b/neutron/cmd/sanity_check.py
@@ -39,6 +39,7 @@ def setup_conf():
     cfg.CONF.import_group('ml2_sriov',
                           'neutron.plugins.ml2.drivers.mech_sriov.mech_driver.'
                           'mech_driver')
+    cfg.CONF.import_group('SECURITYGROUP', 'neutron.agent.securitygroups_rpc')
     dhcp_agent.register_options(cfg.CONF)
     cfg.CONF.register_opts(l3_hamode_db.L3_HA_OPTS)
 
@@ -200,6 +201,14 @@ def check_ebtables():
     return result
 
 
+def check_ipset():
+    result = checks.ipset_supported()
+    if not result:
+        LOG.error(_LE('Cannot run ipset. Please ensure that it '
+                      'is installed.'))
+    return result
+
+
 # Define CLI opts to test specific features, with a callback for the test
 OPTS = [
     BoolOptCallback('ovs_vxlan', check_ovs_vxlan, default=False,
@@ -232,6 +241,8 @@ OPTS = [
                     help=_('Check keepalived IPv6 support')),
     BoolOptCallback('dibbler_version', check_dibbler_version,
                     help=_('Check minimal dibbler version')),
+    BoolOptCallback('ipset_installed', check_ipset,
+                    help=_('Check ipset installation')),
 ]
 
 
@@ -269,6 +280,8 @@ def enable_tests_from_config():
         cfg.CONF.set_override('ovsdb_native', True)
     if cfg.CONF.l3_ha:
         cfg.CONF.set_override('keepalived_ipv6_support', True)
+    if cfg.CONF.SECURITYGROUP.enable_ipset:
+        cfg.CONF.set_override('ipset_installed', True)
 
 
 def all_tests_passed():

diff --git a/neutron/tests/functional/sanity/test_sanity.py b/neutron/tests/functional/sanity/test_sanity.py
index 888469071205099fbef0b226353fe5b56743d0a2..37e81d5fa248bf7d0b4cbc45bf2c5286e36334cf 100644 (file)
--- a/neutron/tests/functional/sanity/test_sanity.py
+++ b/neutron/tests/functional/sanity/test_sanity.py
@@ -38,6 +38,9 @@ class SanityTestCase(base.BaseTestCase):
     def test_dibbler_version(self):
         checks.dibbler_version_supported()
 
+    def test_ipset_support(self):
+        checks.ipset_supported()
+
 
 class SanityTestCaseRoot(functional_base.BaseSudoTestCase):
     """Sanity checks that require root access.