router_centralized_snat ports do not have project_id

[Arnaud Morin]

When adding a subnet to a distributed router, two interfaces are created:
- one for gateway (network:router_interface_distributed)
- one for snat / instance communication (network:router_centralized_snat)

The gw one is having a project_id:

$ openstack port show 4348275a-64bd-439f-be5c-9b3cf1a9160d
...
| project_id | 0819ce415874459dbd0d312cc15badee
...

While the snat one does not:

$ openstack port show 3258ebd9-2be4-4cf9-a110-c619906708ec
...
project_id |
...

Note that, both of them are visible by client:
$ openstack port list -c id -c device_owner
+--------------------------------------+--------------------------------------+----------------------------------+
| ID | device_owner | project_id |
+--------------------------------------+--------------------------------------+----------------------------------+
| 2f972668-e47c-41c1-90a8-17592f69ff3f | compute:nova | 0819ce415874459dbd0d312cc15badee |
| 3258ebd9-2be4-4cf9-a110-c619906708ec | network:router_centralized_snat | |
| 4348275a-64bd-439f-be5c-9b3cf1a9160d | network:router_interface_distributed | 0819ce415874459dbd0d312cc15badee |
| 5ccb4325-b687-4d8c-82d3-ebe5e9f163d0 | network:dhcp | 0819ce415874459dbd0d312cc15badee |
| 93ae1897-7af2-49f3-bfb0-af6050e75ea4 | network:floatingip | 0819ce415874459dbd0d312cc15badee |
+--------------------------------------+--------------------------------------+----------------------------------+

Code in charge of creating the GW port:
https://github.com/openstack/neutron/blob/master/neutron/db/l3_db.py#L761-L799

Code in charge of creating the SNAT port:
https://github.com/openstack/neutron/blob/master/neutron/db/l3_dvr_db.py#L264-L278

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: master
Review: https://review.opendev.org/757599

[LIU Yulong (dragon889)]

IMO, it is a DVR "system internal use" port. It should not be visible to normal user to aviod unexpectedly removal.

[Arnaud Morin (arnaud-morin)]

But it is visible AFAICS.
But it's not possible to delete it with regular user rights:

Failed to delete port with name or ID '3258ebd9-2be4-4cf9-a110-c619906708ec': ConflictException: 409: Client Error for url: http://51.89.5.207:9696/v2.0/ports/3258ebd9-2be4-4cf9-a110-c619906708ec, Port 3258ebd9-2be4-4cf9-a110-c619906708ec cannot be deleted directly via the port API: has device owner network:router_centralized_snat.
1 of 1 ports failed to delete.

For me this is quite the same as a network:router_interface_distributed port, which is also not possible to delete.

I also dont think we should hide it from user, as the port is using an IP from the subnet pool, just like DHCP agent is doing. If we hide it, then is a chance the user think the IP is 'free'.

[Akihiro Motoki (amotoki)]

I agree with Arnaud in general. I am not familiar with DVR implementation, but if an IP address is consumed from a subnet defined by a user, a port which consumes the IP address from the subnet should be visible to the user.
It is what we already do for an interface (router port) of a non-DVR router. A neutron port corresponding to an interface of a non-DVR router is visible to a user but it cannot be deleted as long as a device owner is specified for the port.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Slawek Kaplonski <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/757599
Reason: This review is > 4 weeks without comment, and failed Zuul jobs the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Arnaud Morin (arnaud-morin)]

The commit that introduced the change on the gw:
https://github.com/openstack/neutron/commit/5554d9c5b016bb08c23bba27361bf82dc429f963