Neutron should clean up ACLs in OVN NB DB when a remote security group is deleted
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
neutron |
Fix Released
|
Low
|
Rodolfo Alonso |
Bug Description
Neutron does not clean up ACLs in OVN NB DB when a remote security group is deleted in Neutron. This causes some warning in OVN logs. This issue does not impact functionality but it would be great if we could clean this up and make those logs go away. I think this BZ can be marked as low priority and low hanging fruit.
Reproducing steps:
1. A security group rule which has a rule that uses a remote security group
openstack security group rule list 44038bce-
+------
| ID | IP Protocol | IP Range | Port Range | Remote Security Group |
+------
| 1155ffc7-
| 8e4cdd63-
| b72b29df-
+------
Here is a view in ovn nb db
docker exec -it ovn-dbs-
from-lport 1002 (inport == @pg_44038bce_
from-lport 1002 (inport == @pg_44038bce_
to-lport 1002 (outport == @pg_44038bce_
2. now remove the remote security group and check the rules in the first security group
openstack security group delete 4b0f872b-
openstack security group rule list 44038bce-
+------
| ID | IP Protocol | IP Range | Port Range | Remote Security Group |
+------
| 8e4cdd63-
| b72b29df-
+------
So from neutron the security group rule is removed
3. check the acl in ovn again and see they are still there
docker exec -it ovn-dbs-
from-lport 1002 (inport == @pg_44038bce_
from-lport 1002 (inport == @pg_44038bce_
to-lport 1002 (outport == @pg_44038bce_
this causes warnings to be generated in ovn
2020-11-
2020-11-
What that is happening:
Only security groups that are not in use by other ports can be deleted. If a security group referenced as remote by other group is removed, the security group rule is deleted in DB because of the references in DB tables. It means there is no code triggered in the Neutron code. The corresponding port group is deleted in OVN but OVN doesn't have any on delete cascade functionality like SQL has. It means ACL remains in the OVN DB using port group that no longer exists. It has no impact on the traffic because the deleted security group was not in use.
description: | updated |
Changed in neutron: | |
importance: | Undecided → Low |
status: | New → Confirmed |
tags: | added: backport-potential |
That's right: when the remote SG is deleted, the corresponding SG rules, in the Neutron DB, are deleted; but the OVN ACLs don't. This is because the Neutron DB registers "SecurityGroupRule" are deleted by the DB engine because "remote_group_id" is a foreign key that is removed when the reference is:
class SecurityGroupRu le(standard_ attr.HasStandar dAttributes, model_base.BASEV2,
model_ base.HasId, model_base. HasProject) : sa.String( 36),
sa. ForeignKey( "securitygroups .id",
ondelete= "CASCADE" ),
nullable= True)
"""Represents a v2 neutron security group rule."""
remote_group_id = sa.Column(
And there is another problem: the method "OVNMechanismDr iver._delete_ security_ group" is called AFTER_DELETE. That means both the SG and the related SG rules have been removed. We'll probably need to capture this event before the SG deletion.