Bug 1367678 – [RFE] [Neutron] [OSP-director] Add support for OVS conntrack firewall_driver

Bugzilla will be upgraded to version 5.0. The upgrade date is tentatively scheduled for 2 December 2018, pending final testing and feedback.

Bug 1367678 - [RFE] [Neutron] [OSP-director] Add support for OVS conntrack firewall_driver

Summary:	[RFE] [Neutron] [OSP-director] Add support for OVS conntrack firewall_driver

Status:	CLOSED ERRATA

Aliases:	None

Product:	Red Hat OpenStack
Classification:	Red Hat
Component:	openstack-tripleo-heat-templates (Show other bugs)
Sub Component:
Version:	10.0 (Newton)
Hardware:	Unspecified Unspecified

Priority	medium Severity medium
Target Milestone:	beta
Target Release:	10.0 (Newton)
Assigned To:	Brent Eagles
QA Contact:	Eran Kuris
Docs Contact:

URL:
Whiteboard:
Keywords:	FutureFeature, InstallerIntegration, TechPreview, Triaged

Depends On:
Blocks:	1310654 1325685 1479026
	Show dependency tree / graph

Reported:	2016-08-17 04:38 EDT by Nir Yechiel
Modified:	2017-08-07 14:40 EDT (History)
CC List:	13 users (show)

See Also:	1385341
Fixed In Version:	openstack-tripleo-heat-templates-5.0.0-0.20160929150845.4cdc4fc.el7ost
Doc Type:	Enhancement
Doc Text:	This enhancement adds `NeutronOVSFirewallDriver`, a new parameter for configuring the Open vSwitch (OVS) firewall driver in Red Hat OpenStack Platform director. This was added because the neutron OVS agent supports a new mechanism for implementing security groups: the 'openvswitch' firewall. `NeutronOVSFirewallDriver` allows users to directly control which implementation is used: `hybrid` - configures neutron to use the old iptables/hybrid based implementation. 'openvswitch' - enables the new flow-based implementation. The new firewall driver includes higher performance and reduces the number of interfaces and bridges used to connect guests to the project network. As a result, users can more easily evaluate the new security group implementation.
Story Points:	---
Clone Of:
Environment:
Last Closed:	2016-12-14 10:51:54 EST
Type:	Bug
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
OpenStack gerrit	357556	None	None	None	2016-08-18 20:42 EDT
Red Hat Product Errata	RHEA-2016:2948	normal	SHIPPED_LIVE	Red Hat OpenStack Platform 10 enhancement update	2016-12-14 14:55:27 EST

Groups: None (edit)

Description Nir Yechiel 2016-08-17 04:38:50 EDT

This firewall requires OVS 2.5+ version supporting conntrack and kernel conntrack datapath support (kernel>=4.3). For more information, see hhttps://review.openstack.org/#/c/249337/

Configuration required: 

in openvswitch_agent.ini - securitygroup section - set firewall_driver to openvswitch

Comment 2 Nir Yechiel 2016-09-10 06:31:16 EDT

Patch is now merged in upstream Newton.

Comment 6 Toni Freger 2016-11-07 05:27:08 EST

I have updated virt/network/network-environment.yaml before overcloud deployment with  NeutronOVSFirewallDriver: "openvswitch" .
The firewall driver after installation changed to  "firewall_driver = openvswitch" /etc/neutron/plugins/ml2/openvswitch_agent.ini as it supposed to be.

Setup: 
Controller and Compute on top of RHEL release 7.3
openstack-tripleo-heat-templates-5.0.0-0.6.0rc3.el7ost.noarch
openstack-neutron-9.0.0-1.4.el7ost.noarch


All following tests succeeded to run on this setup: 	
1)test_network_basic_ops.py
2)test_network_advanced_server_ops.py
3)test_security_groups_basic_ops.py

Comment 7 Assaf Muller 2016-11-07 11:20:34 EST

Brent as far as documentation I think we can make do with a doctext here on this RHBZ that would explain how to enable the feature.

Comment 10 errata-xmlrpc 2016-12-14 10:51:54 EST

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHEA-2016-2948.html

Note You need to log in before you can comment on or make changes to this bug.