John Schwarz [Tue, 23 Sep 2014 12:24:47 +0000 (15:24 +0300)]
Divide _cleanup_namespaces for easy extensibility
This division of the function to 2 different functions allows for
easier overwriting in the l3 test agent used by the HA functional
tests, and later by the integration tests.
John Schwarz [Tue, 23 Sep 2014 11:41:54 +0000 (14:41 +0300)]
L3 Agent should generate ns_name in a single place
Currently the l3 agent has 2 places where it allows generating ns_name
of specific router_ids (ie. qrouter-<router_id>): in the RouterInfo's
constructor, and in _cleanup_namespaces. This patch proposes a
unification of this creation code with a property which lives in
RouterInfo's namespace. A simpler fix was also made for snat_ns_name.
This patch also offers a single way to initialize a new RouterInfo.
John Schwarz [Mon, 29 Sep 2014 13:28:18 +0000 (16:28 +0300)]
L3 agent should always use a unique CONF object
The l3 agent accepts an oslo configuration in its constructor and uses
it throughout the code, but there are some references to the global
configuration object held by the oslo library. Since HA functional
tests need to create two agents, the configuration should be consistent
throughout the code.
The important difference between the agents is their 'host' value so
that they create different namespaces, and 'state_path' value so the
agents get their own filesystem root.
John Schwarz [Thu, 18 Sep 2014 08:24:53 +0000 (11:24 +0300)]
Iterate over same port_id if more than one exists
In certain cases where multiple ports can have the same
external_ids:iface_id property, the ovs agent will arbitrarily choose
one and ignore the rest. In case the chosen port isn't on the
integration bridge the ovs agent is managing, an error is returned to
the calling function. This is faulty since one of the other ports may
belong to the correct bridge and it should be chosen instead.
This is interesting for future L3 HA integration tests, where 2
different instances of l3 agents are needed to run on the same machine.
In this case, both agents will register ports which have the same
iface_id property, but obviously only one of the ports is relevant for
each agent.
Mark McClain [Wed, 24 Sep 2014 04:00:54 +0000 (04:00 +0000)]
remove openvswitch plugin
This changeset removes the openvswitch plugin, but retains the agent for ML2
The database models were not removed since operators will need to migrate the
data.
Fix pid file location to avoid I->J changes that break metadata
Changes in commit 7f8ae630b87392193974dd9cb198c1165cdec93b moved
pid files handled by agent/linux/external_process.py from
$state_path/external/<uuid>.pid to $state_path/external/<uuid>/pid
that breaks the neutron-ns-metadata-proxy respawn after upgrades
becase the l3 or dhcp agent can't find the old pid file so
they try to start a new neutron-ns-metadata-proxy which won't
succeed, because the old one is holding the port already.
Ed Bak [Mon, 29 Sep 2014 20:15:52 +0000 (14:15 -0600)]
Don't fail when trying to unbind a router
If a router is already unbound from an l3 agent, don't fail. Log
the condition and go on. This is harmless since it can happen
due to a delete race condition between multiple neutron-server
processes. One delete request can determine that it needs to
unbind the router. A second process may also determine that it
needs to unbind the router. The exception thrown will result
in a port delete failure and cause nova to mark a deleted instance
as ERROR.
Mark McClain [Wed, 24 Sep 2014 01:50:06 +0000 (01:50 +0000)]
remove linuxbridge plugin
This changeset removes the linuxbridge plugin, but retains the agent for ML2.
The database models were not removed since operators will need to migrate the
data.
Additionally, the ml2 migration script was altered to support Juno. For
testing, a user must either run the migration against the icehouse
scheme or run the update, manually change alembic_version to juno and
then run the migration script. Once the juno migration is added, this
manually step will not be required.
Erik Colnick [Wed, 18 Jun 2014 17:31:52 +0000 (11:31 -0600)]
Add admin tenant name to nova notifier
This change introduces the ability to use the nova admin
tenant name with the nova notifier in place of the nova
admin tenant id which may not be available when the neutron
service is being configured as is the case with tripleo
installations where the neutron service is configured and
started before the nova admin tenant has been configured in
keystone and thus does not have a known id.
DocImpact
Introduces the nova_admin_tenant_name configuration entry as
an optional configurable value in neutron.conf. If the
nova_admin_tenant_name is configured and the nova_admin_tenanat_id
is not configured, a performance impact may be seen because
keystone will become involved in communication between neutron
and nova.
Kevin Benton [Tue, 30 Sep 2014 03:21:23 +0000 (20:21 -0700)]
ML2: move L3 cleanup out of network transaction
Move _process_l3_delete out of the delete_network
transaction to eliminate the semaphore deadlock that
occurs when it tries to delete the ports associated
with existing floating IPs.
It makes more sense to live outside of the transaction
anyway because the operations it performs cannot be
rolled back only in the database if the L3 plugin makes
external calls for floating IP creation/deletion.
e.g. if delete_floatingip is successful, it may have
deleted external resources and restoring the DB records
would make things inconsistent.
If a failure to delete the network does occur, any cleanup
done by _process_l3_delete will not be reversed.
Ann Kamyshnikova [Wed, 19 Feb 2014 11:39:19 +0000 (15:39 +0400)]
Implement ModelsMigrationsSync test from oslo.db
Add tests to verify that database migrations produce
the same schema as the database models.
Also for MySQL, check that all tables are configured to use InnoDB
as the storage engine.
These tests make use of the ModelsMigrationsSync test class from
oslo.db and the load_tests protocol from Python unittest.
John Kasperski [Thu, 25 Sep 2014 15:38:45 +0000 (10:38 -0500)]
Update migration scripts to support DB2
Three of the migration scripts are causing failures with DB2.
- DB2 doesn't support nullable column in primary key
- Hard coded SQL statements which use False/True as Boolean arguments
are not compatible with DB2. In DB2, Boolean columns are created as
small integer with a constraint to allow only 0 & 1.
- Hardcoded update rows from other table sql is not compatible with DB2
Note: There are several other unrelated unit tests that also break with a
randomized PYTHONHASHSEED, but they are not addressed here. They will be
addressed in separate patches.
When admin policy p1 is shared and is used by firewall f1 of different tenant,
then updating p1 with shared=False should not be allowed as it is in use.
Eugene Nikanorov [Sun, 24 Aug 2014 20:59:02 +0000 (00:59 +0400)]
Raise exception if ipv6 prefix is inappropriate for address mode
Address prefix to use with slaac and stateless ipv6 address modes
should be equal to 64 in order to work properly.
The patch adds corresponding validation and fixes unit tests
accordingly.
Kevin Benton [Sat, 20 Sep 2014 07:17:58 +0000 (00:17 -0700)]
Fix broken port query in Extraroute test case
One of the queries in an extra route test case tries
to filter based on the port owner, but the _list_ports
method it calls doesn't take a device_owner parameter.
This can cause failures if a DHCP port is created on
the same subnet.
The patch being reverted here addresses an issue that can no longer be
reproduced, in that under no circumstances, I can make the FIP lie around
before deleting a router (which can only be done after all FIP have been
disassociated or released).
Unless we have more clarity as to what the initial commit was really meant
to fix, there is a strong case for reverting this patch at this point.
Michael Smith [Wed, 24 Sep 2014 17:20:46 +0000 (10:20 -0700)]
fix dvr snat bindings for external-gw-clear
When router_gateway_clear happens, the
schedule_router calls the unbind_snat_servicenode
in the plugin. This will clear the agent binding
from the binding table. But the l3-agent was
expecting the ex_gw_port binding to be present.
The agent needs to check its cache of the
router['gw_host_port'] value now.
Yong Sheng Gong [Mon, 30 Jun 2014 07:01:17 +0000 (15:01 +0800)]
Deletes floating ip related connection states
When a floating ip is dissociated with a port, the current
connection with the floating ip is still working. This patch
will clear the connection state and cut off the connection
immediately.
Since conntrack -D will return 1, which is not an error code,
so add extra_ok_codes argument to execute methods.
Brian Haley [Thu, 18 Sep 2014 01:48:53 +0000 (21:48 -0400)]
Do not lookup l3-agent for floating IP if host=None, dvr issue
If a floating IP has been associated with a port, but the port
has not been associated with an instance, attempting to lookup
the l3-agent hosting it will cause an AgentNotFoundByTypeHost
exception. Just skip it and go onto the next one.
Carl Baldwin [Fri, 19 Sep 2014 17:37:17 +0000 (17:37 +0000)]
Remove RPC notification from transaction in create/update port
Removing notifications to the L3 agent from within the transaction in
create_port and update_port eliminates many lock wait timeouts in the
dvr check queue job and in scale testing locally.
Since this patch leaves context unused in _process_port_binding, the
argument is removed from the method.
Jacek Swiderski [Wed, 6 Aug 2014 09:23:16 +0000 (11:23 +0200)]
Do not assume order of body and tags elements
This fixes the l2gateway unit test that breaks with a randomized PYTHONHASHSEED
(see the bug report).
The test assumed that the body dict from self._create_expected_req_body
had elements (including contents of tags list) in a particular order.
Found with PYTHONHASHSEED=2455351445.
The fix ensures that body is in predictable order.
Partial-bug: #1348818
Note: There are several other unrelated unit tests that also break with a
randomized PYTHONHASHSEED, but they are not addressed here. They will be
addressed in separate patches.
On systems that start both neutron-server and neutron-l3-agent together,
there is a chance that the first call to neutron will timeout. Retry upto
4 more times to avoid the l3 agent exiting on startup.
This should make the l3 agent a little more robust on startup but still
not ideal, ideally it wouldn't exit and retry periodically.
Elena Ezhova [Tue, 19 Aug 2014 11:54:36 +0000 (15:54 +0400)]
Forbid regular users to reset admin-only attrs to default values
A regular user can reset an admin-only attribute to its default
value due to the fact that a corresponding policy rule is
enforced only in the case when an attribute is present in the
target AND has a non-default value.
Added a new attribute "attributes_to_update" which contains a list
of all to-be updated attributes to the body of the target that is
passed to policy.enforce.
Changed a check for whether an attribute is explicitly set.
Now, in the case of update, the function should not pay attention
to a default value of an attribute, but check whether it was
explicitly marked as being updated.
Gary Kotton [Mon, 22 Sep 2014 17:03:37 +0000 (10:03 -0700)]
Security groups: prevent race for default security group creation
When a VM is booted via the Nova the client connection is created
with an admin user. This causes problems when creating the neutron
port. That is, there may be a race for the creation of the default
security group for the tenant.
The problem was introduced by commit acf44dba26ca8dca47bfb5fb2916807f9f4e2060
If the firewall rules are not shared and if they belong to different
tenants, then admin should not be able to create a policy using
these rules and he should not be able to insert such rules into
policies. An exception should be raised in such case. Added new
exception “FirewallRuleConflict” to handle such conditions.
Neutron cannot possibly be passing tests under Python 2.6, as
neutron/tests/unit/test_api_v2.py is referencing
collections.OrderedDict, which does not exist in Python 2.6.
Since there is no reason to use an OrderedDict in this case,
this replaces it with a simple dict.
Kevin Benton [Sat, 20 Sep 2014 17:48:22 +0000 (10:48 -0700)]
Mock out all RPC calls with a fixture
Mock out the rpc proxy calls used by various agents to
prevent unit tests from blocking for 10+ seconds while waiting
for a timeout. This happened with the OVS agent unit tests
recently in Change-ID Idd770a85a9eabff112d9613e75d8bb524020234a.
This change results in a reduction from 330.8 seconds to 2.7 seconds
for the neutron.tests.unit.openvswitch.test_ovs_neutron_agent
test module.
Elena Ezhova [Tue, 26 Aug 2014 15:22:20 +0000 (19:22 +0400)]
Add logging for enforced policy rules
There are a lot of policy rules which should not necessarily
be explicitly specified in policy.json to be checked while enforcement.
There should be a way for an operator to know which policy rules are
actually being enforced for each action.
Kevin Benton [Thu, 18 Sep 2014 11:21:05 +0000 (04:21 -0700)]
Remove unnecessary _make_port function in BSN UTs
The Big Switch unit tests had unnecessary copies of the
_make_port function to allow the binding:host_id field to
be set. This was already possible with the existing _make_port
call through the use of kwargs so the extra function wasn't
necessary.
Code Review / openstack-build / neutron-build.git / log