[OVN] Missing OVN ACLs for security groups that utilize remote groups attached to ports with allowed_address_pairs

[Krzysztof Klimonda]

See mailing list thread started at http://lists.openstack.org/pipermail/openstack-discuss/2020-December/019442.html

Bug discovered during magnum testing in ussuri, where pods deployed on different nodes could not communicate with each other - it has been traced to incorrect OVN ACLs for this specific scenario:

- neutron port with additional subnet added to allowed_address_pairs
- security group created with a remote group set for both TCP and UDP, to allow traffic between subnet defined in allowed_address_pairs

It resulted in TCP and UDP being dropped by OVN.

[Bartosz Bezak (bbezak)]

one possible workaround to this issue in Magnum is to use Calico overlay.
Can be set with cluster template label:
calico_ipv4pool_ipip=Always

[Slawek Kaplonski (slaweq)]

This bug has had a related patch abandoned and has been automatically un-assigned due to inactivity. Please re-assign yourself if you are continuing work or adjust the state as appropriate if it is no longer valid.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Slawek Kaplonski <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/772983
Reason: This review is > 4 weeks without comment, and failed Zuul jobs the last time it was checked. We are abandoning this for now. Feel free to reactivate the review by pressing the restore button and leaving a 'recheck' comment to get fresh test results.

[Lars Wiegman (lars-fuga)]

I am experiencing the same issue with Magnum Ussuri in combination with OVN and would like to know what is holding back the patch.

[OpenStack Infra (hudson-openstack)]

Change abandoned by "Michal Nasiadka <email address hidden>" on branch: master
Review: https://review.opendev.org/c/openstack/neutron/+/772983
Reason: seems to not be needed anymore

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/magnum 14.0.0.0rc1 release candidate.

[Rodolfo Alonso (rodolfo-alonso-hernandez)]

Bug closed due to lack of activity, please feel free to reopen if needed.