Bug 1441780 - [RFE][HA] Support DHCP filtering drivers
Summary: [RFE][HA] Support DHCP filtering drivers
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-ironic-inspector
Version: 7.0 (Kilo)
Hardware: Unspecified
OS: Unspecified
Target Milestone: Upstream M3
: 12.0 (Pike)
Assignee: mkovacik
QA Contact: Dan Yasny
Depends On:
Blocks: 1214284 1288035 1441788 1441800 1442136
TreeView+ depends on / blocked
Reported: 2017-04-12 17:22 UTC by mkovacik
Modified: 2018-02-05 19:07 UTC (History)
9 users (show)

Fixed In Version: openstack-ironic-inspector-5.1.1-0.20170705203602.c38596e.el7ost
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2017-12-13 21:23:38 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Launchpad 1665666 0 None None None 2017-04-12 17:22:42 UTC
OpenStack gerrit 439603 0 None None None 2017-05-04 12:42:05 UTC
OpenStack gerrit 439862 0 None None None 2017-05-04 12:41:16 UTC
OpenStack gerrit 457765 0 None None None 2017-05-04 12:42:53 UTC
Red Hat Product Errata RHEA-2017:3462 0 normal SHIPPED_LIVE Red Hat OpenStack Platform 12.0 Enhancement Advisory 2018-02-16 01:43:25 UTC

Description mkovacik 2017-04-12 17:22:43 UTC
Ironic inspector requires a PXE/DHCP service to boot a node.
To avoid interference w/ normal Nova instance booting, inspector utilizes a firewall filter to limit the access to the DHCP service for already inspected nodes.
Because of the discovery feature, the filter uses a blacklist--whitelist semantics.
Current implementation (L2 in iptables) prevents the leaf--spine topology which requires relaying the DHCP traffic across multiple L2 broadcast domains (L3).
Another limitation is the HA deployment that the current filter implementation doesn't support (single iptables instance).

This bug tracks the effort to refactor inspector to support different DHCP filtering drivers.

Comment 2 Dmitry Tantsur 2017-04-13 07:03:44 UTC
Thanks! Adding this to 12, as this is a de-scoped version of previously approved https://bugzilla.redhat.com/show_bug.cgi?id=1288035. Also fixing the status (it's not merged yet).

Comment 4 Ramon Acedo 2017-04-13 08:55:34 UTC
Based on the description this RFE is a requirement for leaf-spine (BZ#1214284)

Comment 8 mkovacik 2017-06-30 12:04:23 UTC
All the changes were merged upstream.

Comment 12 Dan Yasny 2017-10-26 13:53:18 UTC
Tested and verified

Comment 15 errata-xmlrpc 2017-12-13 21:23:38 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.