[Bug 2115328] Re: [uca][zed][antelope][bobcat] Upgrade failure due to missing patches

Thu Sep 17 22:11:53 UTC 2026

This bug was fixed in the package ovn - 23.03.1-1ubuntu0.23.04.1~cloud4
---------------

 ovn (23.03.1-1ubuntu0.23.04.1~cloud4) jammy-antelope; urgency=medium
 .
   * d/p/debian/patches/lp2115328-*: Add missing actions required for
     successful upgrade (LP: #2115328).

** Changed in: cloud-archive/antelope
       Status: Fix Committed => Fix Released

-- 
You received this bug notification because you are a member of Ubuntu
OpenStack, which is subscribed to Ubuntu Cloud Archive.
https://bugs.launchpad.net/bugs/2115328

Title:
  [uca][zed][antelope][bobcat] Upgrade failure due to missing patches

Status in Ubuntu Cloud Archive:
  New
Status in Ubuntu Cloud Archive antelope series:
  Fix Released
Status in Ubuntu Cloud Archive bobcat series:
  Fix Released
Status in Ubuntu Cloud Archive zed series:
  Fix Released
Status in ovn package in Ubuntu:
  Invalid

Bug description:
  [Impact]

  Updated OVN 22.03 packages in Jammy generate Southbound logical flows using
  the ct_commit_nat action and flags.from_ctrl field. The original OVN
  22.09.1 packages in Zed do not understand these constructs.

  During the upgrade, ovn-controller rejects the affected logical flows,
  logging:

    error parsing actions "ct_commit_nat;": Syntax error at
    `ct_commit_nat' expecting action.

    error parsing match "flags.from_ctrl && udp.src == 53": Syntax error at
    `flags.from_ctrl' expecting field name.

  This prevents the affected flows from being installed and can disrupt
  network traffic during the upgrade.

  [Test Plan]

  Deploy a multinode Jammy Yoga OpenStack cloud using updated OVN 22.03 packages.
  Configure instances on different compute hosts, security groups, floating
  IPs, OVN DNS records.

  Confirm that the Southbound database contains flows referencing both
  ct_commit_nat and flags.from_ctrl.

  Verify that:

  * All relevant units install the candidate package and their OVN
    services remain healthy.
  * No ct_commit_nat or flags.from_ctrl parsing errors appear in the
    ovn-controller logs during the upgrade.
  * Controllers converge and process subsequent network configuration.
  * Existing and newly created instances have working east-west and
    floating-IP connectivity.
  * OVN DNS resolution works with security groups enabled.
  * Related ICMP traffic through an OVN load balancer is delivered with
    the correct NAT translation.

  Run the OpenStack functional and upgrade tests and attach the
  results, package versions, and relevant logs before marking verification
  complete.

  [Where problems could occur]

  The patches change logical action parsing, load-balancer handling of
  related traffic, and the ACL treatment of OVN-generated DNS responses.

  Regressions could affect connection tracking or NAT for related ICMP
  traffic, prevent logical flows from being installed, or incorrectly allow
  or block DNS traffic.

  Validation must cover both existing connections and new network
  configuration after the upgrade. DNS testing must confirm that legitimate
  OVN-generated replies work while workload-generated traffic remains
  subject to the configured security-group rules.

  [Other Info]
  After discussion with other Cloud Archive admin, we've deemed that a multi node deployment testing yoga -> zed -> antelope -> bobcat upgrade test is sufficient to validate these patches, and does not require a full charmed openstack deployment. Updated the original testplan, and keep this comment for history.

  --- Original Description

  The charmed OpenStack product currently make use of a step by step
  upgrade process.

  This includes stepping through interim releases of OVN.

  While OVN itself supports direct upgrades between LTS versions, it is
  impractical in the current organization of apt repositories.

  Between 22.03 and 22.04 releases, two new actions has been introduced
  and backported to resolve critical issues.

  These patches have made their way into the ovn 22.03 package in Jammy,
  but not to the intermediate versions currently maintained in UCA.  As
  a consequence, when users attempt to upgrade they will hit an data
  path impacting issue, and find messages below logged by the ovn-
  controller:

  The required patches to resolve this are:
  474bdfcad038 ("Skip only OVN DNS responder packets from OUT_ACL.")
  650f06b9f3e2 ("northd: Allow related traffic through LB")
  31196346fcad ("actions: Add new action called ct_commit_nat")

To manage notifications about this bug go to:
https://bugs.launchpad.net/cloud-archive/+bug/2115328/+subscriptions