[Bug 1951296] Re: [SRU] OVN db sync script fails with OVN schema that has label column in ACL table

Mon Apr 3 12:19:42 UTC 2023

Hello Jakub, or anyone else affected,

Accepted neutron into focal-proposed. The package will build now and be
available at
https://launchpad.net/ubuntu/+source/neutron/2:16.4.2-0ubuntu6.1 in a
few hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
focal to verification-done-focal. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-focal. In either case, without details of your testing we will
not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: neutron (Ubuntu Focal)
       Status: New => Fix Committed

** Tags added: verification-needed verification-needed-focal

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1951296

Title:
  [SRU] OVN db sync script fails with OVN schema that has label column
  in ACL table

Status in Ubuntu Cloud Archive:
  New
Status in Ubuntu Cloud Archive ussuri series:
  New
Status in Ubuntu Cloud Archive victoria series:
  Fix Released
Status in Ubuntu Cloud Archive wallaby series:
  Fix Released
Status in Ubuntu Cloud Archive xena series:
  Fix Released
Status in Ubuntu Cloud Archive yoga series:
  Fix Released
Status in Ubuntu Cloud Archive zed series:
  Fix Released
Status in neutron:
  Fix Released
Status in neutron package in Ubuntu:
  New
Status in neutron source package in Focal:
  Fix Committed

Bug description:
  [Impact]
  Backport fix to Focal/Ussuri so that neutron-ovn-db-sync-util does not trip up when it finds ovn ACL table entries with a "label" column that does not exist in neutron db.

  [Test Plan]
   * Deploy Openstack Ussuri
   * Upgrade OVN to 22.03 (https://charmhub.io/ovn-chassis/configure?channel=22.03/stable#ovn-source)
   * Create a network with security groups
   * Create an instance using this network so that ports get tied to SGs
   * Go to neutron-api unit (neutron-server) and do the following
   * cp /etc/neutron/neutron.conf /etc/neutron/neutron.conf.no_keystone_authtoken
   * remove "auth_section = keystone_authtoken" in the [nova] section of neutron.conf.no_keystone_authtoken
   * run 'neutron-ovn-db-sync-util --config-file /etc/neutron/neutron.conf.no_keystone_authtoken --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --ovn-neutron_sync_mode repair'
   * the above should not produce any errors like the following:

      RuntimeError: ACL ... already exists

  [Regression Potential]
  there is no regression potential expected with this patch.

  --------------------------------------------------------------------------

  OVN introduced a new column in ACL table. The column name is label and
  when running db-sync script, we compare ACL generated by the ovn mech
  driver from Neutron DB with the actual ACLs in the OVN DB. Because of
  the new label column, everything seems like a new ACL because the
  column differs to what Neutron generated. Thus the script attempts to
  create a new ACL that already exists.

      b'Traceback (most recent call last):'
      b'  File "/usr/local/lib/python3.6/site-packages/neutron/tests/base.py", line 181, in func'
      b'    return f(self, *args, **kwargs)'
      b'  File "/usr/local/lib/python3.6/site-packages/neutron/tests/base.py", line 181, in func'
      b'    return f(self, *args, **kwargs)'
      b'  File "/home/cloud-user/networking-ovn/networking_ovn/tests/functional/test_ovn_db_sync.py", line 1547, in test_ovn_nb_sync_repair'
      b"    self._test_ovn_nb_sync_helper('repair')"
      b'  File "/home/cloud-user/networking-ovn/networking_ovn/tests/functional/test_ovn_db_sync.py", line 1543, in _test_ovn_nb_sync_helper'
      b'    self._sync_resources(mode)'
      b'  File "/home/cloud-user/networking-ovn/networking_ovn/tests/functional/test_ovn_db_sync.py", line 1523, in _sync_resources'
      b'    nb_synchronizer.do_sync()'
      b'  File "/home/cloud-user/networking-ovn/networking_ovn/ovn_db_sync.py", line 104, in do_sync'
      b'    self.sync_acls(ctx)'
      b'  File "/home/cloud-user/networking-ovn/networking_ovn/ovn_db_sync.py", line 288, in sync_acls'
      b'    txn.add(self.ovn_api.pg_acl_add(**acla))'
      b'  File "/usr/lib64/python3.6/contextlib.py", line 88, in __exit__'
      b'    next(self.gen)'
      b'  File "/home/cloud-user/networking-ovn/networking_ovn/ovsdb/impl_idl_ovn.py", line 230, in transaction'
      b'    yield t'
      b'  File "/usr/lib64/python3.6/contextlib.py", line 88, in __exit__'
      b'    next(self.gen)'
      b'  File "/usr/local/lib/python3.6/site-packages/ovsdbapp/api.py", line 110, in transaction'
      b'    del self._nested_txns_map[cur_thread_id]'
      b'  File "/usr/local/lib/python3.6/site-packages/ovsdbapp/api.py", line 61, in __exit__'
      b'    self.result = self.commit()'
      b'  File "/usr/local/lib/python3.6/site-packages/ovsdbapp/backend/ovs_idl/transaction.py", line 65, in commit'
      b'    raise result.ex'
      b'  File "/usr/local/lib/python3.6/site-packages/ovsdbapp/backend/ovs_idl/connection.py", line 131, in run'
      b'    txn.results.put(txn.do_commit())'
      b'  File "/usr/local/lib/python3.6/site-packages/ovsdbapp/backend/ovs_idl/transaction.py", line 93, in do_commit'
      b'    command.run_idl(txn)'
      b'  File "/usr/local/lib/python3.6/site-packages/ovsdbapp/schema/ovn_northbound/commands.py", line 124, in run_idl'
      b'    self.direction, self.priority, self.match))'
      b'RuntimeError: ACL (from-lport, 1001, inport == @neutron_pg_drop && ip) already exists'

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1951296/+subscriptions