Bug 2300098 - Manila IPAM approach for NetAppDriver is not aligned with OVN internals and OVN breaks network communications between VMs and shares
Summary: Manila IPAM approach for NetAppDriver is not aligned with OVN internals and O...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat OpenStack
Classification: Red Hat
Component: openstack-manila
Version: 17.1 (Wallaby)
Hardware: Unspecified
OS: All
urgent
high
Target Milestone: z4
: 17.1
Assignee: Goutham Pacha Ravi
QA Contact: Alfredo
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-26 17:04 UTC by Alex Stupnikov
Modified: 2024-11-21 09:42 UTC (History)
9 users (show)

Fixed In Version: openstack-manila-12.1.3-17.1.20240829070802.ba479a4.el9ost
Doc Type: Bug Fix
Doc Text:
Before this update, if you used an external network as a share network for the Shared File Systems service (manila), an incompatibility in OVN caused incorrect ARP responses for ports that were created on external switches attached to external storage systems. Client machines, such as virtual machines, containers, or bare metal nodes, could not reach shares that were exported on external networks. + With this update, the Shared File Systems service sets the OpenStack network port status to DOWN to prevent OVN from setting up ARP responses through Networking service (neutron) ports. Instead, MAC addresses are learned from the external ports. Client machines can reach shares that are exported on external networks, and they can mount the shares when there are access control lists (ACLs) in the Shared File Systems service.
Clone Of:
Environment:
Last Closed: 2024-11-21 09:42:01 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Launchpad 2074504 0 None None None 2024-07-29 18:55:00 UTC
OpenStack gerrit 925315 0 None MERGED Create ports as disabled with external networks 2024-08-28 21:39:17 UTC
OpenStack gerrit 925316 0 None NEW Create ports as disabled with external networks 2024-08-29 13:48:15 UTC
Red Hat Issue Tracker OSP-32574 0 None None None 2024-07-26 17:05:12 UTC
Red Hat Product Errata RHBA-2024:9974 0 None None None 2024-11-21 09:42:04 UTC

Description Alex Stupnikov 2024-07-26 17:04:13 UTC
Description of problem:
Goutham from RHOS Storage engineering was already involved in ongoing escalation for one of our customers and knows context. Shortly speaking, MAC address used by NetApp storage to host shares is not static and impossible to predict. As a result, a manila:share port created by Manila has a MAC address that doesn't match real MAC address used by storage.

This situation causes problems inside OVN because it expects different MAC address to be used by VMs when they are communicating with storage. As a result, traffic is dropped. One of workarounds proposed by OVN team is to disable Neutron port.

There is existing issue https://issues.redhat.com/browse/FDP-697 reported for OVN, I am reporting this bug to ask Manila team to check if it is possible to do something on their side and maybe discuss this problem with OVN engineers. For example, disabling the port in Neutron fixes this problem and if port is only created for IPAM purposes, then maybe disabling it will help? Or this is not going to work because we rely on OVN to create some security groups?

Version-Release number of selected component (if applicable):
RHOSP 17.1


Steps to Reproduce:
1. Create a share with NetApp backend
2. Try to ping share from some VM

Actual results: no network connectivity


Expected results: VM is able to reach NetApp storage


Additional info: there is extensive discussion in attached support case

Comment 20 errata-xmlrpc 2024-11-21 09:42:01 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (RHOSP 17.1.4 bug fix and enhancement advisory), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2024:9974


Note You need to log in before you can comment on or make changes to this bug.