Bug 1830743
| Summary: | OVN-DVR on Red Hat OpenStack Platform release 16.0.1 (Train), DNAT not working for IPv4 with VLAN tenant network + VLAN provider network | ||
|---|---|---|---|
| Product: | Red Hat OpenStack | Reporter: | Andreas Karis <akaris> |
| Component: | openstack-neutron | Assignee: | Assaf Muller <amuller> |
| Status: | CLOSED DUPLICATE | QA Contact: | Eran Kuris <ekuris> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 16.0 (Train) | CC: | amuller, chrisw, jlibosva, scohen |
| Target Milestone: | --- | ||
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | If docs needed, set a value | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-05-05 14:19:46 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Comment 1
Andreas Karis
2020-05-03 16:12:26 UTC
I think you're hitting bug 1704596 - the DVR with VLAN doesn't work well and we're working on it. If you think it's really a dup, we can close this one. Hi,
Thanks, I'm currently looking into this. Just for completeness, here's the overcloud setup (networks) that did not work for me.
~~~
(overcloud) [stack@undercloud-0 ~]$ cat ovn_dvr/common/overcloud-test/overcloud-test-ovn-dvr.sh
#!/bin/bash
PROVIDER_SEGMENTATION_ID_PRIVATE=206
PROVIDER_SEGMENTATION_ID_PRIVATE2=207
PROVIDER_SEGMENTATION_ID_EXTERNAL=209
PROVIDER_PHYSICAL_NETWORK="tenant"
PROVIDER_PHYSICAL_NETWORK_EXTERNAL="tenant"
(...)
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
source /home/stack/overcloudrc
if ! `neutron net-list | grep -q private1`;then
neutron net-create private1 --provider:network_type vlan --provider:physical_network $PROVIDER_PHYSICAL_NETWORK --provider:segmentation_id $PROVIDER_SEGMENTATION_ID_PRIVATE --shared --router:external
fi
if ! `neutron net-list | grep -q private2`;then
neutron net-create private2 --provider:network_type vlan --provider:physical_network $PROVIDER_PHYSICAL_NETWORK --provider:segmentation_id $PROVIDER_SEGMENTATION_ID_PRIVATE2 --shared --router:external
fi
if ! `neutron net-list | grep -q provider1-ovn`;then
neutron net-create provider1-ovn --provider:network_type vlan --provider:physical_network $PROVIDER_PHYSICAL_NETWORK_EXTERNAL --provider:segmentation_id $PROVIDER_SEGMENTATION_ID_EXTERNAL --shared --router:external
fi
if ! `neutron subnet-list | grep -q provider1-ovn-subnet`;then
neutron subnet-create --gateway 172.31.0.1 --allocation-pool start=172.31.0.200,end=172.31.0.250 --dns-nameserver 10.11.5.4 --name provider1-ovn-subnet provider1-ovn 172.31.0.0/24
fi
if ! `neutron subnet-list | grep -q provider1-ovn-ipv6-subnet`;then
neutron subnet-create --ip-version 6 --ipv6-ra-mode slaac --ipv6-address-mode slaac --gateway 2000:10::250 --name provider1-ovn-ipv6-subnet provider1-ovn 2000:10::/64
fi
if ! `neutron router-list | grep -q router`;then
neutron router-create router
neutron router-gateway-set router provider1-ovn
fi
if ! `neutron router-list | grep -q router-ipv6`;then
neutron router-create router-ipv6
neutron router-gateway-set router-ipv6 provider1-ovn
fi
if ! `neutron subnet-list | grep -q private1-subnet`;then
neutron subnet-create --name private1-subnet private1 192.168.0.0/24 --allocation-pool start=192.168.0.100,end=192.168.0.150
neutron router-interface-add router private1-subnet
fi
if ! `neutron subnet-list | grep -q private1-ipv6-subnet`;then
neutron subnet-create --ip-version 6 --ipv6-ra-mode slaac --ipv6-address-mode slaac --name private1-ipv6-subnet private1 2000:192:168:0::/64
neutron router-interface-add router-ipv6 private1-ipv6-subnet
fi
if ! `neutron subnet-list | grep -q private2-subnet`;then
neutron subnet-create --name private2-subnet private2 192.168.1.0/24 --allocation-pool start=192.168.1.100,end=192.168.1.150
neutron router-interface-add router private2-subnet
fi
if ! `neutron subnet-list | grep -q private2-ipv6-subnet`;then
neutron subnet-create --ip-version 6 --ipv6-ra-mode slaac --ipv6-address-mode slaac --name private2-ipv6-subnet private2 2000:192:168:1::/64
neutron router-interface-add router-ipv6 private1-ipv6-subnet
fi
/bin/bash ${DIR}/cirros-image-create.sh
/bin/bash ${DIR}/rhel-image-create.sh
project_id=`openstack project list | awk '/admin/ {print $2}'`
security_group_id=`openstack security group list | grep $project_id | awk '{print $2}'`
openstack security group rule create ${security_group_id} --protocol icmp --remote-ip 0.0.0.0/0
openstack security group rule create ${security_group_id} --protocol tcp --dst-port 1:65535 --remote-ip 0.0.0.0/0
openstack security group rule create ${security_group_id} --protocol udp --dst-port 1:65535 --remote-ip 0.0.0.0/0
openstack security group rule create ${security_group_id} --ethertype IPv6 --protocol icmp --remote-ip ::/0
openstack security group rule create ${security_group_id} --ethertype IPv6 --protocol tcp --dst-port 1:65535 --remote-ip ::/0
openstack security group rule create ${security_group_id} --ethertype IPv6 --protocol udp --dst-port 1:65535 --remote-ip ::/0
if ! `nova keypair-list | grep -q id_rsa`;then
nova keypair-add --pub-key ~/.ssh/id_rsa.pub id_rsa
fi
if ! `nova flavor-list | grep -q m1.tiny`;then
nova flavor-create m1.tiny auto 512 8 1
fi
if ! `nova flavor-list | grep -q m1.small`;then
nova flavor-create m1.small auto 1024 16 1
fi
/bin/bash ${DIR}/overcloud-test-ovn-spawn-rhel.sh
/bin/bash ${DIR}/overcloud-test-ovn-spawn-cirros.sh
~~~
------------------------
~~~
(overcloud) [stack@undercloud-0 ~]$ cat ovn_dvr/common/overcloud-test/overcloud-test-ovn-spawn-rhel.sh
#!/bin/bash
PROVIDER_SEGMENTATION_ID_PRIVATE=206
PROVIDER_SEGMENTATION_ID_PRIVATE2=207
PROVIDER_SEGMENTATION_ID_EXTERNAL=209
PROVIDER_PHYSICAL_NETWORK="tenant"
PROVIDER_PHYSICAL_NETWORK_EXTERNAL="tenant"
PROVIDER_NETWORK="provider1-ovn"
CIRROS_INSTANCE_COUNT=1
RHEL_INSTANCE_COUNT=1
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
source /home/stack/overcloudrc
PROVIDERNETID=$(openstack network show $PROVIDER_NETWORK -c id -f value)
NETID=$(neutron net-list | grep private1 | awk '{print $2}')
for i in `seq 1 $RHEL_INSTANCE_COUNT`;do
uuid=$(uuidgen | cut -b 1-8)
openstack floating ip create $PROVIDERNETID
nova boot --nic net-id=$NETID --image rhel --flavor m1.small --key-name id_rsa rhel-test-${uuid}
FLOATINGIP=$(openstack floating ip list --network $PROVIDERNETID --long | grep DOWN | awk '{print $2}' | head -1)
sleep 10
openstack server add floating ip rhel-test-${uuid} $FLOATINGIP
done
~~~
And updated version:
(undercloud) [stack@undercloud-0 ~]$ cat ovn_dvr/common/overcloud-test/overcloud-test-ovn-dvr.sh
#!/bin/bash
PROVIDER_SEGMENTATION_ID_PRIVATE=206
PROVIDER_SEGMENTATION_ID_PRIVATE2=207
PROVIDER_SEGMENTATION_ID_EXTERNAL=209
PROVIDER_PHYSICAL_NETWORK="tenant"
PROVIDER_PHYSICAL_NETWORK_EXTERNAL="tenant"
(...)
DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" >/dev/null 2>&1 && pwd )"
source /home/stack/overcloudrc
if ! `neutron net-list | grep -q private1`;then
neutron net-create private1 --provider:network_type geneve
# neutron net-create private1 --provider:network_type vlan --provider:physical_network $PROVIDER_PHYSICAL_NETWORK --provider:segmentation_id $PROVIDER_SEGMENTATION_ID_PRIVATE --shared --router:external
fi
if ! `neutron net-list | grep -q private2`;then
neutron net-create private2 --provider:network_type geneve
# neutron net-create private2 --provider:network_type vlan --provider:physical_network $PROVIDER_PHYSICAL_NETWORK --provider:segmentation_id $PROVIDER_SEGMENTATION_ID_PRIVATE2 --shared --router:external
fi
if ! `neutron net-list | grep -q provider1-ovn`;then
neutron net-create provider1-ovn --provider:network_type vlan --provider:physical_network $PROVIDER_PHYSICAL_NETWORK_EXTERNAL --provider:segmentation_id $PROVIDER_SEGMENTATION_ID_EXTERNAL --shared --router:external
fi
if ! `neutron subnet-list | grep -q provider1-ovn-subnet`;then
neutron subnet-create --gateway 172.31.0.1 --allocation-pool start=172.31.0.200,end=172.31.0.250 --dns-nameserver 10.11.5.4 --name provider1-ovn-subnet provider1-ovn 172.31.0.0/24
fi
if ! `neutron subnet-list | grep -q provider1-ovn-ipv6-subnet`;then
neutron subnet-create --ip-version 6 --ipv6-ra-mode slaac --ipv6-address-mode slaac --gateway 2000:10::250 --name provider1-ovn-ipv6-subnet provider1-ovn 2000:10::/64
fi
if ! `neutron router-list | grep -q router`;then
neutron router-create router
neutron router-gateway-set router provider1-ovn
fi
if ! `neutron router-list | grep -q router-ipv6`;then
neutron router-create router-ipv6
neutron router-gateway-set router-ipv6 provider1-ovn
fi
if ! `neutron subnet-list | grep -q private1-subnet`;then
neutron subnet-create --name private1-subnet private1 192.168.0.0/24 --allocation-pool start=192.168.0.100,end=192.168.0.150
neutron router-interface-add router private1-subnet
fi
if ! `neutron subnet-list | grep -q private1-ipv6-subnet`;then
neutron subnet-create --ip-version 6 --ipv6-ra-mode slaac --ipv6-address-mode slaac --name private1-ipv6-subnet private1 2000:192:168:0::/64
neutron router-interface-add router-ipv6 private1-ipv6-subnet
fi
if ! `neutron subnet-list | grep -q private2-subnet`;then
neutron subnet-create --name private2-subnet private2 192.168.1.0/24 --allocation-pool start=192.168.1.100,end=192.168.1.150
neutron router-interface-add router private2-subnet
fi
if ! `neutron subnet-list | grep -q private2-ipv6-subnet`;then
neutron subnet-create --ip-version 6 --ipv6-ra-mode slaac --ipv6-address-mode slaac --name private2-ipv6-subnet private2 2000:192:168:1::/64
neutron router-interface-add router-ipv6 private1-ipv6-subnet
fi
/bin/bash ${DIR}/cirros-image-create.sh
/bin/bash ${DIR}/rhel-image-create.sh
project_id=`openstack project list | awk '/admin/ {print $2}'`
security_group_id=`openstack security group list | grep $project_id | awk '{print $2}'`
openstack security group rule create ${security_group_id} --protocol icmp --remote-ip 0.0.0.0/0
openstack security group rule create ${security_group_id} --protocol tcp --dst-port 1:65535 --remote-ip 0.0.0.0/0
openstack security group rule create ${security_group_id} --protocol udp --dst-port 1:65535 --remote-ip 0.0.0.0/0
openstack security group rule create ${security_group_id} --ethertype IPv6 --protocol icmp --remote-ip ::/0
openstack security group rule create ${security_group_id} --ethertype IPv6 --protocol tcp --dst-port 1:65535 --remote-ip ::/0
openstack security group rule create ${security_group_id} --ethertype IPv6 --protocol udp --dst-port 1:65535 --remote-ip ::/0
if ! `nova keypair-list | grep -q id_rsa`;then
nova keypair-add --pub-key ~/.ssh/id_rsa.pub id_rsa
fi
if ! `nova flavor-list | grep -q m1.tiny`;then
nova flavor-create m1.tiny auto 512 8 1
fi
if ! `nova flavor-list | grep -q m1.small`;then
nova flavor-create m1.small auto 1024 16 1
fi
/bin/bash ${DIR}/overcloud-test-ovn-spawn-rhel.sh
/bin/bash ${DIR}/overcloud-test-ovn-spawn-cirros.sh
Making the comments public as this is my lab environment and doesn't contain any customer data. After the change in comment 5 (and after migrating or restarting the instance, see https://bugzilla.redhat.com/show_bug.cgi?id=1830734 ) (overcloud) [stack@undercloud-0 ~]$ sudo ip neigh del 172.31.0.201 dev eth2.209 (overcloud) [stack@undercloud-0 ~]$ ping 172.31.0.201 -c1 -W1 PING 172.31.0.201 (172.31.0.201) 56(84) bytes of data. 64 bytes from 172.31.0.201: icmp_seq=1 ttl=63 time=1.96 ms --- 172.31.0.201 ping statistics --- 1 packets transmitted, 1 received, 0% packet loss, time 0ms rtt min/avg/max/mdev = 1.961/1.961/1.961/0.000 ms (overcloud) [stack@undercloud-0 ~]$ [root@overcloud-controller-0 ~]# tcpdump -nne -i ens5 -l | egrep -i '172.31.0.201|172.31.0.1' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ens5, link-type EN10MB (Ethernet), capture size 262144 bytes 14:14:29.332200 52:54:00:2e:2e:2e > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 209, p 0, ethertype ARP, Request who-has 172.31.0.201 tell 172.31.0.1, length 28 [root@overcloud-controller-1 ~]# tcpdump -nne -i ens5 -l | egrep -i '172.31.0.201|172.31.0.1' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ens5, link-type EN10MB (Ethernet), capture size 262144 bytes 14:14:29.332322 52:54:00:2e:2e:2e > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 209, p 0, ethertype ARP, Request who-has 172.31.0.201 tell 172.31.0.1, length 28 [root@overcloud-controller-2 ~]# tcpdump -nne -i ens5 -l | egrep -i '172.31.0.201|172.31.0.1' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on ens5, link-type EN10MB (Ethernet), capture size 262144 bytes 14:14:29.332151 52:54:00:2e:2e:2e > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 46: vlan 209, p 0, ethertype ARP, Request who-has 172.31.0.201 tell 172.31.0.1, length 28 [root@overcloud-novacompute-0 ~]# tcpdump -nne -i bond_api -l | egrep -i '172.31.0.201|172.31.0.1' tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on bond_api, link-type EN10MB (Ethernet), capture size 262144 bytes 14:14:29.332654 52:54:00:2e:2e:2e > ff:ff:ff:ff:ff:ff, ethertype 802.1Q (0x8100), length 64: vlan 209, p 0, ethertype ARP, Request who-has 172.31.0.201 tell 172.31.0.1, length 46 14:14:29.333065 fa:16:3e:9b:7b:fb > 52:54:00:2e:2e:2e, ethertype 802.1Q (0x8100), length 64: vlan 209, p 0, ethertype ARP, Reply 172.31.0.201 is-at fa:16:3e:9b:7b:fb, length 46 14:14:29.333326 52:54:00:2e:2e:2e > fa:16:3e:9b:7b:fb, ethertype 802.1Q (0x8100), length 102: vlan 209, p 0, ethertype IPv4, 172.31.0.1 > 172.31.0.201: ICMP echo request, id 21173, seq 1, length 64 14:14:29.334233 fa:16:3e:9b:7b:fb > 52:54:00:2e:2e:2e, ethertype 802.1Q (0x8100), length 102: vlan 209, p 0, ethertype IPv4, 172.31.0.201 > 172.31.0.1: ICMP echo reply, id 21173, seq 1, length 64 *** This bug has been marked as a duplicate of bug 1704596 *** So thanks. Indeed, OVN-DVR currently does not seem to work at all if the tenant network is of type VLAN: https://bugzilla.redhat.com/show_bug.cgi?id=1704596 On the other hand, if the provider network is of type VLAN, then we hit: https://bugzilla.redhat.com/show_bug.cgi?id=1830734 |