Ironic inspector requires a PXE/DHCP service to boot a node.
To avoid interference w/ normal Nova instance booting, inspector utilizes a firewall filter to limit the access to the DHCP service for already inspected nodes.
Because of the discovery feature, the filter uses a blacklist--whitelist semantics.
Current implementation (L2 in iptables) prevents the leaf--spine topology which requires relaying the DHCP traffic across multiple L2 broadcast domains (L3).
Another limitation is the HA deployment that the current filter implementation doesn't support (single iptables instance).
This bug tracks the effort to refactor inspector to support different DHCP filtering drivers.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHEA-2017:3462