Ironic inspector requires a PXE/DHCP service to boot a node.
To avoid interference w/ normal Nova instance booting, inspector utilizes a firewall filter to limit the access to the DHCP service for already inspected nodes.
Because of the discovery feature, the filter uses a blacklist--whitelist semantics.
Current implementation (L2 in iptables) prevents the leaf--spine topology which requires relaying the DHCP traffic across multiple L2 broadcast domains (L3).
Another limitation is the HA deployment that the current filter implementation doesn't support (single iptables instance).
This bug tracks the effort to refactor inspector to support different DHCP filtering drivers.
The patch: https://review.openstack.org/#/c/439603
The specification: https://specs.openstack.org/openstack/ironic-inspector-specs/specs/multiple-pxe-filtering-backends.html
Thanks! Adding this to 12, as this is a de-scoped version of previously approved https://bugzilla.redhat.com/show_bug.cgi?id=1288035. Also fixing the status (it's not merged yet).
Based on the description this RFE is a requirement for leaf-spine (BZ#1214284)
All the changes were merged upstream.
Tested and verified
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.