Floating IP disassociation does not work

[Daniel Alvarez]

Removing a FIP from a port does not work:

[centos@centos networking-ovn]$ openstack floating ip set --port 51cebfef-39a7-4996-81e6-dd48a4a81dfd 003a724b-24ca-4e6c-a9eb-1d0b58221300

[centos@centos networking-ovn]$ sudo ovn-nbctl list nat |grep dnat_and_snat -B5
external_ids : {"neutron:fip_id"="003a724b-24ca-4e6c-a9eb-1d0b58221300", "neutron:fip_port_id"="51cebfef-39a7-4996-81e6-dd48a4a81dfd", "neutron:revision_number"="2", "neutron:router_name"="neutron-0fd652d1-f17d-464d-9b1c-68fd88dec5c3"}
external_ip : "172.24.4.24"
external_mac : []
logical_ip : "10.0.0.10"
logical_port : []
type : dnat_and_snat

[centos@centos networking-ovn]$ openstack floating ip unset 172.24.4.24
[centos@centos networking-ovn]$ ping 172.24.4.24
PING 172.24.4.24 (172.24.4.24) 56(84) bytes of data.
64 bytes from 172.24.4.24: icmp_seq=1 ttl=63 time=0.925 ms
64 bytes from 172.24.4.24: icmp_seq=2 ttl=63 time=0.385 ms
^C
--- 172.24.4.24 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.385/0.655/0.925/0.270 ms

[centos@centos networking-ovn]$ sudo ovn-nbctl list nat |grep dnat_and_snat -B5
external_ids : {"neutron:fip_id"="003a724b-24ca-4e6c-a9eb-1d0b58221300", "neutron:fip_port_id"="51cebfef-39a7-4996-81e6-dd48a4a81dfd", "neutron:revision_number"="2", "neutron:router_name"="neutron-0fd652d1-f17d-464d-9b1c-68fd88dec5c3"}
external_ip : "172.24.4.24"
external_mac : []
logical_ip : "10.0.0.10"
logical_port : []
type : dnat_and_snat

If I try to unset the FIP it still "succeeds" from an API perspective:

[centos@centos networking-ovn]$ openstack floating ip unset 172.24.4.24ç
[centos@centos networking-ovn]$ ping 172.24.4.24
PING 172.24.4.24 (172.24.4.24) 56(84) bytes of data.
64 bytes from 172.24.4.24: icmp_seq=1 ttl=63 time=0.925 ms
64 bytes from 172.24.4.24: icmp_seq=2 ttl=63 time=0.385 ms
^C
--- 172.24.4.24 ping statistics ---
2 packets transmitted, 2 received, 0% packet loss, time 1000ms
rtt min/avg/max/mdev = 0.385/0.655/0.925/0.270 ms

[centos@centos networking-ovn]$ sudo ovn-nbctl list nat |grep dnat_and_snat -B5
external_ids : {"neutron:fip_id"="003a724b-24ca-4e6c-a9eb-1d0b58221300", "neutron:fip_port_id"="51cebfef-39a7-4996-81e6-dd48a4a81dfd", "neutron:revision_number"="2", "neutron:router_name"="neutron-0fd652d1-f17d-464d-9b1c-68fd88dec5c3"}
external_ip : "172.24.4.24"
external_mac : []
logical_ip : "10.0.0.10"
logical_port : []
type : dnat_and_snat

Looks like DeleteNATRuleInLRouterCommand is not taking effect.

[Daniel Alvarez (dalvarezs)]

Problem seems to be earlier as I can't see neutron calling l3_ovn service plugin to disassociate (nor update) the floating ip here:

http://git.openstack.org/cgit/openstack/networking-ovn/tree/networking_ovn/l3/l3_ovn.py#n254

[Daniel Alvarez (dalvarezs)]

Perhaps the openstack client is broken as per:

Network client initialized using OpenStack SDK: <openstack.network.v2._proxy.Proxy object at 0x7f4b677d4690>
Manager RegionOne running task network.GET.floatingips
REQ: curl -g -i -X GET http://10.200.16.10:9696/v2.0/floatingips/172.24.4.3 -H "User-Agent: openstacksdk/0.17.2 keystoneauth1/3.11.0 python-requests/2.14.2 CPython/2.7.5" -H "X-Auth-Token: {SHA256}b741859d0022c3d0ae0b5ed6fa879c8d1aeef4812f890e945c6ffddeb9b66267"
Starting new HTTP connection (1): 10.200.16.10
http://10.200.16.10:9696 "GET /v2.0/floatingips/172.24.4.3 HTTP/1.1" 404 118
RESP: [404] Connection: keep-alive Content-Length: 118 Content-Type: application/json Date: Fri, 26 Oct 2018 13:33:21 GMT X-Openstack-Request-Id: req-869fef00-3beb-4774-a83f-51ab178e61b0
RESP BODY: {"NeutronError": {"message": "Floating IP 172.24.4.3 could not be found", "type": "FloatingIPNotFound", "detail": ""}}
GET call to network for http://10.200.16.10:9696/v2.0/floatingips/172.24.4.3 used request id req-869fef00-3beb-4774-a83f-51ab178e61b0
Manager RegionOne ran task network.GET.floatingips in 0.159759998322s
Manager RegionOne running task network.GET.floatingips
REQ: curl -g -i -X GET http://10.200.16.10:9696/v2.0/floatingips -H "Accept: application/json" -H "User-Agent: openstacksdk/0.17.2 keystoneauth1/3.11.0 python-requests/2.14.2 CPython/2.7.5" -H "X-Auth-Token: {SHA256}b741859d0022c3d0ae0b5ed6fa879c8d1aeef4812f890e945c6ffddeb9b66267"
http://10.200.16.10:9696 "GET /v2.0/floatingips HTTP/1.1" 200 550
RESP: [200] Connection: keep-alive Content-Length: 550 Content-Type: application/json Date: Fri, 26 Oct 2018 13:33:21 GMT X-Openstack-Request-Id: req-28d07621-b414-4b79-b9b5-f8e45a72450e
RESP BODY: {"floatingips": [{"router_id": "0fd652d1-f17d-464d-9b1c-68fd88dec5c3", "status": "ACTIVE", "description": "", "tags": [], "tenant_id": "aa853adbd20e46fea02776a1189d6c86", "created_at": "2018-10-26T13:32:20Z", "updated_at": "2018-10-26T13:32:32Z", "floating_network_id": "ef71d6ca-7640-45c1-aed3-e2b8cef15c28", "fixed_ip_address": "10.0.0.10", "floating_ip_address": "172.24.4.3", "revision_number": 2, "project_id": "aa853adbd20e46fea02776a1189d6c86", "port_id": "51cebfef-39a7-4996-81e6-dd48a4a81dfd", "id": "31332cff-c71b-4396-b0cd-90fb18d43376"}]}
GET call to network for http://10.200.16.10:9696/v2.0/floatingips used request id req-28d07621-b414-4b79-b9b5-f8e45a72450e
Manager RegionOne ran task network.GET.floatingips in 0.064600944519s
clean_up UnsetFloatingIP:
END return value: 0

[Daniel Alvarez (dalvarezs)]

neutron floatingip-disassociate works so it's an OSC issue.

[Brian Haley (brian-haley)]

I can confirm that using horizon I can associate/dis-associate a floating IP to an instance, but with the openstack client it fails silently:

stack@18-04:~/devstack$ openstack floating ip list
+--------------------------------------+---------------------+------------------+------+--------------------------------------+----------------------------------+
| ID | Floating IP Address | Fixed IP Address | Port | Floating Network | Project |
+--------------------------------------+---------------------+------------------+------+--------------------------------------+----------------------------------+
| 201b989b-71ff-40bf-8b16-a6a8b42f8f68 | 172.24.4.3 | None | None | 1370e537-cd38-4dc1-a71f-750e0783d904 | 7e167d30d6174e678645ae8a49697e20 |
+--------------------------------------+---------------------+------------------+------+--------------------------------------+----------------------------------+

stack@18-04:~/devstack$ openstack floating ip unset 201b989b-71ff-40bf-8b16-a6a8b42f8f68
stack@18-04:~/devstack$ nova list
+--------------------------------------+-------------+--------+------------+-------------+--------------------------------------------------------------------+
| ID | Name | Status | Task State | Power State | Networks |
+--------------------------------------+-------------+--------+------------+-------------+--------------------------------------------------------------------+
| c045c343-b239-44f0-b18a-4850dafd9f99 | dev_server1 | ACTIVE | - | Running | private=10.0.0.7, fdf1:5659:b530:0:f816:3eff:fe9d:530e, 172.24.4.3 |
+--------------------------------------+-------------+--------+------------+-------------+--------------------------------------------------------------------+

Silently fails too :(

[Brian Haley (brian-haley)]

Also, the neutron client works:

stack@18-04:~/devstack$ neutron floatingip-disassociate 201b989b-71ff-40bf-8b16-a6a8b42f8f68
neutron CLI is deprecated and will be removed in the future. Use openstack CLI instead.
Disassociated floating IP 201b989b-71ff-40bf-8b16-a6a8b42f8f68

stack@18-04:~/devstack$ nova list
+--------------------------------------+-------------+--------+------------+-------------+--------------------------------------------------------+
| ID | Name | Status | Task State | Power State | Networks |
+--------------------------------------+-------------+--------+------------+-------------+--------------------------------------------------------+
| c045c343-b239-44f0-b18a-4850dafd9f99 | dev_server1 | ACTIVE | - | Running | private=10.0.0.7, fdf1:5659:b530:0:f816:3eff:fe9d:530e |
+--------------------------------------+-------------+--------+------------+-------------+--------------------------------------------------------+

[Brian Haley (brian-haley)]

Daniel - so this looks like user error, but even multiple people thought it was broken, myself included. Amotoki pointed out you need to use the '--port' on the unset as well:

# openstack floating ip unset --port ...

That did work for me, can you verify that works with OVN?

The neutron CLI to openstack CLI decoder doc had this wrong, I've proposed a patch to fix that and other issues, https://review.openstack.org/#/c/613605/

Now that this bug isn't owned by a neutron component I can't change the status though.

[Brian Haley (brian-haley)]

Had to move this back from neutron to flip the status bit.