Add log monitor for RBAC issues in ovn-controller logs

Bug #1908949 reported by Drew Freiberger
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
charm-ovn-chassis
New
Undecided
Unassigned

Bug Description

We've experienced issues of flapping neutron agent alerts that come along with errors in the /var/log/ovn/ovn-controller.log such as:

2020-12-18T06:24:53.376Z|291200|ovsdb_idl|WARN|transaction error: {"details":"RBAC rules for client \"compute-1.fqdn\" role \"ovn-controller\" prohibit modification of table \"Port_Binding\".","error":"permission error"}

There is a related bug https://bugs.launchpad.net/charm-layer-ovn/+bug/1896630 which affects Octavia and/or MAAS+LXD units, but this is also happening on hypervisor metals deployed with MAAS.

It would be good to have monitoring alerting us to the cause of the flapping agents being related to RBAC issues within the database.

This may actually be a neutron-server interaction with the southbound DB issue, as the SBDB matches all of the information from OVS on the compute unit, but the above Port_Binding update is failing. We've found that a restart of neutron-server on charm-neutron-api can alleviate this if the OVN database and OVS agent database are in sync, but neutron still fails to see the live agent as stable.

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.