[Bug 1939723] Re: neutron-ovn-db-sync generates insufficient flow

[nikhil kshirsagar]

When I tried to test the same fix also for the cloud archive, I ran into
this issue if I tried it on focal/ussuri deployed using stsstack, (this
is on a neutron-api leader node)

root at juju-408761-fixtestnew-ca-6:/etc/apt/sources.list.d# add-apt-repository cloud-archive:ussuri-proposed
 Ubuntu Cloud Archive for OpenStack Ussuri [proposed]
 More info: https://wiki.ubuntu.com/OpenStack/CloudArchive
Press [ENTER] to continue or Ctrl-c to cancel adding it.

cloud-archive for Ussuri-proposed only supported on bionic

And if I try on bionic, I run into several charms not supported, first
of which is ovn itself which doesnt have latest/stable listed at
https://charmhub.io/ovn-central

ubuntu at nkshirsagar-bastion:~/stsstack-bundles/openstack$ ./generate-bundle.sh -s bionic -r ussuri -n fixtest-bionic-new --run --ovn
Creating Juju model fixtest-bionic-new
Added 'fixtest-bionic-new' model on stsstack/stsstack with credential 'nkshirsagar' for user 'admin'

Created bionic-ussuri bundle and overlays:
  + glance.yaml
  + keystone.yaml
  + mysql.yaml
  + rabbitmq-source.yaml
  + neutron-ovn.yaml
  + neutron-ml2dns.yaml
  + placement.yaml
  + vault.yaml
  + vault-openstack-secrets.yaml
  + vault-openstack-certificates.yaml
  + vault-openstack-certificates-placement.yaml

Command to deploy:
juju deploy /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/openstack.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/glance.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/keystone.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/mysql.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/rabbitmq-source.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/neutron-ovn.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/neutron-ml2dns.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/placement.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/vault.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/vault-openstack-secrets.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/vault-openstack-certificates.yaml --overlay /home/ubuntu/stsstack-bundles/openstack/b/fixtest-bionic-new/o/vault-openstack-certificates-placement.yaml 
 
Located charm "cinder" in charm-hub, channel ussuri/stable
Located charm "glance" in charm-hub, channel ussuri/stable
Located charm "keystone" in charm-hub, channel ussuri/stable
Located charm "percona-cluster" in charm-hub, channel 5.7/stable
Located charm "neutron-api" in charm-hub, channel ussuri/stable
Located charm "neutron-api-plugin-ovn" in charm-hub, channel ussuri/stable
Located charm "nova-cloud-controller" in charm-hub, channel ussuri/stable
Located charm "nova-compute" in charm-hub, channel ussuri/stable
ERROR cannot deploy bundle: cannot resolve charm or bundle "ovn-central": no releases found for channel "latest/stable"

So I am not sure how to actually test the cloud archive packages on
focal/ussuri.

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/1939723

Title:
  neutron-ovn-db-sync generates insufficient flow

Status in Ubuntu Cloud Archive:
  Fix Released
Status in Ubuntu Cloud Archive ussuri series:
  Fix Committed
Status in Ubuntu Cloud Archive victoria series:
  Fix Released
Status in Ubuntu Cloud Archive wallaby series:
  Fix Released
Status in Ubuntu Cloud Archive xena series:
  Fix Released
Status in Ubuntu Cloud Archive yoga series:
  Fix Released
Status in Ubuntu Cloud Archive zed series:
  Fix Released
Status in neutron:
  Fix Released
Status in neutron package in Ubuntu:
  Fix Released
Status in neutron source package in Focal:
  Fix Committed

Bug description:
  = Original bug description =

  In OpenStack version Victoria, neutron-ovn-db-sync generates insufficient flow for port no security-group or disable port-security.
  ---> As a result, the port is not connected to the network.

  = Ubuntu SRU details =

  [Impact]
  The neutron-ovn-db-sync tool is used to syncing neutron networks and ports with OVN databases. When the tool is run, ports with port security disabled are incorrectly being added to the drop port group causing all traffic to be dropped by default.

  [Test Case]
  - Create a VM
  - Disable port security
  - Remove NB & SB DB
  - Run command neutron-ovn-db-sync-util to resync from neutron to NB database
  neutron-ovn-db-sync-util --config-file /etc/neutron/neutron.conf --config-file /etc/neutron/plugins/ml2/ml2_conf.ini --ovn-neutron_sync_mode repair
  - Restart ovn-controller
  - VM with port disable security die without the fix

  [Regression Potential]
  This is a simple patch that fixes the logic of an if statement. This has been fixed in the victoria+ Ubuntu package versions since 2022-01-12, and has been fixed in the upstream stable/ussuri branch since 2021-11-11.

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/1939723/+subscriptions