Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.

Bug 2143941

Summary:	Creating octavia loadbalancer fails due to openflow rules not being matched when port security enabled on healthmanager port in octavia-worker
Product:	Red Hat OpenStack	Reporter:	Randy Rubins <rrubins>
Component:	openstack-neutron	Assignee:	OSP Team <rhos-maint>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Eran Kuris <ekuris>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	16.2 (Train)	CC:	bcafarel, chrisw, echaudro, gregraka, gthiemon, ihrachys, lpeer, majopela, njohnston, rhos-maint, scohen
Target Milestone:	---	Keywords:	Tracking
Target Release:	---	Flags:	rrubins: needinfo- ralonso: needinfo-
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openvswitch2.15-2.15.0-126.el8fdp.x86_64	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2023-01-25 13:16:19 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2081773
Bug Blocks:

Description Randy Rubins 2022-11-18 12:50:18 UTC

Description of problem:
Creating octavia loadbalancer fails due to openflow rules not being matched when port security enabled on healthmanager port in octavia-worker.  egress traffic from octavia-worker does not reach amphora on tcp/9443.

Version-Release number of selected component (if applicable):
OSP 16.2, openstack-octavia-worker-5.1.3-2.20220328185156.el8ost

How reproducible:
With openvswitch native firewall and port-security enabled on octavia-worker (o-hm) port, the creation of load balancer does not complete and errors out (see below).  Removing port-security on that port enables loadbalancer to be created.

Steps to Reproduce:
1. create loadbalancer with port security enabled (ovs-fw) on o-hm port
2. traffic unable to egress/reach amphora instance on tcp/9443
3. only entirely removing port-security resolves the issue.  If security group rules are adjusted to allow all egress tcp/udp traffic from that port, it still does not resolve the issue.

Actual results:
Failure in ovs-fw / openflow rules matching cause dropped packets and octavia loadbalancer creation fails.

Expected results:
Openflow rules should be matched and egress should be allowed.

Additional info:

Comment 11 Randy Rubins 2023-01-25 13:16:19 UTC

Thank you! This can be closed based on comment #6.