[RFE] Add VPNaaS support for OVN networking

[MingShuang Xian]

Problem Description

Currently VPNaaS service plugin only has support for the reference Neutron software routers, such as neutron L3 router. It can't work together with OVN distributed router.

Proposed Change

Add a new VPN agent to support VPN+OVN, the new VPN agent can support any distributed router solution. Together with the new agent, changes for VPNaaS plugin service driver are also needed. This will have no impact on existing VPN solution. The existing VPN agent can still work with neutron l3 router. This does not need any changes for OVN l3 plugin. So it is compatible with current OVN L3 plugin.

[MingShuang Xian (xianms)]

Our team are working on this issue, so I assign it to me.

[Armando Migliaccio (armando-migliaccio)]

Frankly, I'd rather see the VPN team focus on how to improve the viability of the project long term rather than adding new features on a quick sands. IIRC VPNaaS changes are still not thoroughly tested via the upstream CI.

[MingShuang Xian (xianms)]

Hi Armando, thank you so much for your comments. Could you give me more details about the CI testing which VPNaaS changes can't pass? I'd like to work on it also.

We do need the VPN with OVN, it's our customer's requirements.

[Kyle Mestery (mestery)]

I don't think we should allow new features into VPN while the current VPN CI is a giant disaster and the team isn't focusing on fixing that. So I agree with armax in that settling VPN itself should be more important here.

[Kyle Mestery (mestery)]

Also, I think this affects networking-ovn and perhaps not Neutron, so adding that project here as well. I think we should remove Neutron from the affected projects list to be honest, as this could be done somewhere else. But fixing VPN should be priority #1.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/334401

[MingShuang Xian (xianms)]

Hi Armax and Kyle. Today our team have submitted two CI test patches. More CI test patches will be submitted later.
https://review.openstack.org/#/c/335828/
https://review.openstack.org/#/c/335838/

[Armando Migliaccio (armando-migliaccio)]

Thanks for helping out, there's a few issues with the patches you posted. Please see review comments.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/351511

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/351520

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/363338

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/368468

[OpenStack Infra (hudson-openstack)]

Change abandoned by Roshan Harr (<email address hidden>) on branch: master
Review: https://review.openstack.org/363338
Reason: Could not back out from some fetches

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.openstack.org/369479

[OpenStack Infra (hudson-openstack)]

Change abandoned by Armando Migliaccio (<email address hidden>) on branch: master
Review: https://review.openstack.org/368468
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[OpenStack Infra (hudson-openstack)]

Change abandoned by Armando Migliaccio (<email address hidden>) on branch: master
Review: https://review.openstack.org/369479
Reason: This review is > 4 weeks without comment, and failed Jenkins the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Armando Migliaccio (armando-migliaccio)]

http://lists.openstack.org/pipermail/openstack-dev/2016-November/107384.html

[Steffen Neubauer (sneubauer)]

My colleage Bodo submitted another patch based on this work.

See also https://bugs.launchpad.net/neutron/+bug/1905391 and https://review.opendev.org/c/openstack/neutron-vpnaas/+/765353

[Przemysław Kuczyński (przemekkuczynski)]

When VPNaaS support for OVN will be ready to use ?
How we could implement this using kolla-ansible or manually ?