Linux Bridge Container Permission Issues

[Luke Short]

Description
===========
When deploying TripleO using Linux Bridge (instead of Open vSwitch), the Neutron service is ran on bare-metal as the "neutron" user. This causes conflicts with data being read and written to /var/lib/container/neutron from within a Neutron container. This causes Neutron resources to be created from the API but not actually working in the back-end (ex. routers relying on SNAT).

Steps to reproduce
==================
Deploy TripleO with the template `environments/neutron-linuxbridge.yaml`.

Expected result
===============
Neutron resources work with proper routing.

Actual result
=============
The linuxbridge-agent service does not work.

Environment
===========
I was testing with Queens and I assume this probably affects newer versions of TripleO, too.

Logs & Configs
==============
Error from /var/log/neutron/linuxbridge-agent.log: http://paste.openstack.org/show/789183/
Workaround: http://paste.openstack.org/show/789184/

The workaround does not automagically fix any existing/broken resources created while the permissions were incorrect.

There is also a note in the environment Heat template stating how it is not containerized: https://github.com/openstack/tripleo-heat-templates/blob/stable/queens/environments/neutron-linuxbridge.yaml

[Luke Short (ekultails)]

This only affects older versions of TripleO. CentOS 8 (used by >= Train) does not ship bridge-utils which includes the `brctl` utility required. Using Linux Bridge will no longer be supported (it never was officially supported anyways).

[Luke Short (ekultails)]

I got confirmation that Linux Bridge is not tested in CI and that legacy Linux bridges are not be supported in RHEL 8. Operators who opt to use Linux bridge will only create a large barrier when it comes to upgrades from EL 7 to 8 and will get little to no support.