[networking] firewall_driver attribute missing from ML2 config

[Liam Haworth]

The openstack-networking cookbook is missing the follow setting,

 `openstack['network']['ml2']['firewall_driver']`

and its reference in the ML2 configuration template file. This is a required setting for Neutron to operate correctly, if the setting is missing Neutron will fail on any call regarding security groups.

The fix would be as simple as adding the settings into the template file and adding the default firewall driver (as stated in the docs http://docs.openstack.org/kilo/install-guide/install/apt/content/neutron-network-node.html).

[Mark Vanderwiel (vanderwl)]

There is already a reference to this on the ubuntu side as the ovs template is pulled in.
https://github.com/stackforge/cookbook-openstack-network/blob/master/templates/default/plugins/ml2/ml2_conf.ini.erb#L76
https://github.com/stackforge/cookbook-openstack-network/blob/master/templates/default/plugins/openvswitch/ovs_neutron_plugin.ini.erb#L174

is this only for redhat?

[Liam Haworth (liam-haworth)]

I'm currently using the stable/juno branch of the cookbook which doesn't contain that change

https://github.com/stackforge/cookbook-openstack-network/blob/stable/juno/templates/default/plugins/ml2/ml2_conf.ini.erb#L72

vs

https://github.com/stackforge/cookbook-openstack-network/blob/master/templates/default/plugins/ml2/ml2_conf.ini.erb#L76

Is it possible to have the change back ported?

[Mark Vanderwiel (vanderwl)]

Yes, a backport can be done, I think would need a couple of patches:

https://github.com/stackforge/cookbook-openstack-network/commit/7963c596c9a8bfbff6c1ea67d8851a5efea672f9
https://github.com/stackforge/cookbook-openstack-network/commit/7bbe7573b0af5e89bb790600660a98764b12b2d6

Not sure how clean these would come across, some refactoring might be needed.