Firewall creation/deletion stalls pending forever >= newton

[José Pekkarinen]

In an ocata deployment with the following configuration on neutron-gateway and
neutron-openvswitch, trying to create a firewall through fwaas stalls forever:

  neutron-gateway:
    annotations:
      gui-x: '0'
      gui-y: '0'
    charm: cs:~openstack-charmers-next/xenial/neutron-gateway
    num_units: 1
    options:
      openstack-origin: cloud:xenial-ocata
      bridge-mappings: physnet1:br-ex
      data-port: br-ex:ethX.X
      worker-multiplier: 0.25
    to:
    - '0'
  neutron-openvswitch:
    annotations:
      gui-x: '250'
      gui-y: '500'
    charm: cs:~openstack-charmers-next/xenial/neutron-openvswitch
    num_units: 0

Steps to reproduce:

1) Create a couple of rules:

neutron firewall-rule-create --source-ip-address 0.0.0.0/32 --destination-ip-address X.X.X.X/24 --destination-port 80 --enable true --protocol tcp --action allow --name http
neutron firewall-rule-create --source-ip-address 0.0.0.0/32 --destination-ip-address X.X.X.X/24 --destination-port 20 --enable true --protocol tcp --action allow --name ssh

2) Create a policy:

neutron firewall-policy-create --firewall-rules "http ssh" test_policy

3) Create a router:

neutron router-create test-router
neutron router-gateway-set test-router public_net
neutron router-interface-add test-router private_subnet

4) Create a firewall:

neutron firewall-create --name test-fw --router test-router test_policy

Created a new firewall:
+--------------------+--------------------------------------+
| Field | Value |
+--------------------+--------------------------------------+
| admin_state_up | True |
| description | |
| firewall_policy_id | 1ab576a4-1c58-4afb-9b8e-03a1c1482719 |
| id | 50139345-23c9-40c1-aa45-dcd90856c8b5 |
| name | cli-test-fw |
| project_id | ca0861a638bb42ad9d9e048fdde1e0fa |
| router_ids | 38be5530-966b-4056-8bcc-019d90cf2621 |
| status | PENDING_CREATE |
| tenant_id | ca0861a638bb42ad9d9e048fdde1e0fa |
+--------------------+--------------------------------------+

Status will never change from that even in hours.

Removing it will be pending until you destroy the router completely.

Best regards.

José.

[James Page (james-page)]

Revalidated on xenial/mitaka - firewall correctly went active.

[James Page (james-page)]

Confirmed this bug on xenial-ocata using openstack-charm-testing bundles and the following commands:

  neutron firewall-rule-create --source-ip-address 0.0.0.0/32 --destination-ip-address 192.168.21.0/24 --destination-port 80 --enable true --protocol tcp --action allow --name http
  neutron firewall-rule-create --source-ip-address 0.0.0.0/32 --destination-ip-address 192.168.21.0/24 --destination-port 22 --enable true --protocol tcp --action allow --name ssh
  neutron firewall-policy-create --firewall-rules "http ssh" test_policy
  neutron firewall-create --name test-fw --router provider-router test_policy
  neutron firewall-show bc2f4f5b-08ee-4dfc-8749-7c1453d236b5

[James Page (james-page)]

Some minor tweaks required to neutron-gateway templates to re-enable this feature >= newton AFAICT

[James Page (james-page)]

https://review.openstack.org/508100

[James Page (james-page)]

If you happen to have a firewall stuck in PENDING_CREATE, you can reset it using:

  neutron firewall-update --no-routers UUID

which will place it back into INACTIVE state; after upgrading to the fixed version of the charm, the router can then be set back again, e.g:

  neutron firewall-update --router=ef61d331-6493-430b-92da-ab98144e5f90 bc2f4f5b-08ee-4dfc-8749-7c1453d236b5

at which point it should go active.

[James Page (james-page)]

Proposed fix can be tested from:

  cs:~james-page/neutron-gateway-4

using

  juju upgrade-charm --switch cs:~james-page/neutron-gateway-4 neutron-gateway

Thanks!

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/508100
Committed: https://git.openstack.org/cgit/openstack/charm-neutron-gateway/commit/?id=7ab7046153926b543ac07b229dff09481c3d2fb7
Submitter: Zuul
Branch: master

commit 7ab7046153926b543ac07b229dff09481c3d2fb7
Author: James Page <email address hidden>
Date: Thu Sep 28 10:42:49 2017 +0100

    Fix support for FWaaS for >= Newton

    Newton introduced the new v2 driver for the l3-agent; update
    configuration to stick with v1 for the time being, ensuring
    that firewalls can actually be applied to routers.

    Change-Id: I44b7b84a1805bc096ffdd072665189146f63eba9
    Closes-Bug: 1680164

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/17.08
Review: https://review.openstack.org/508889

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/508889
Committed: https://git.openstack.org/cgit/openstack/charm-neutron-gateway/commit/?id=bb523e4f9c4fc2c342d3abe17598c080a8368d19
Submitter: Zuul
Branch: stable/17.08

commit bb523e4f9c4fc2c342d3abe17598c080a8368d19
Author: James Page <email address hidden>
Date: Thu Sep 28 10:42:49 2017 +0100

    Fix support for FWaaS for >= Newton

    Newton introduced the new v2 driver for the l3-agent; update
    configuration to stick with v1 for the time being, ensuring
    that firewalls can actually be applied to routers.

    Change-Id: I44b7b84a1805bc096ffdd072665189146f63eba9
    Closes-Bug: 1680164
    (cherry picked from commit 7ab7046153926b543ac07b229dff09481c3d2fb7)