Enhance DHCP agent and IP library for networking-calico interface driver

Bug #1486649 reported by Nell Jerram
10
This bug affects 1 person
Affects Status Importance Assigned to Milestone
neutron
Fix Released
High
Nell Jerram

Bug Description

networking-calico will very shortly provide an ML2 mechanism driver, DHCP agent interface driver and Devstack plugin to demonstrate the Calico project's idea of using routing - rather than bridging - to provide IP-level connectivity between VMs.

The existing Neutron DHCP agent provides a great deal of value in terms of managing Dnsmasq, and of mapping from Neutron data to Dnsmasq config, and networking-calico would very much like to reuse that value, rather than say implementing its own DHCP agent. But, the DHCP agent needs two changes to allow it to provide DHCP service correctly and efficiently in the compute host environment that networking-calico sets up.

1. It needs to invoke Dnsmasq with some different options, because of TAP interfaces in the networking-calico setup not being bridged.

2. It does not need to allocate a unique IP address, from each DHCP-enabled subnet, in each place that it runs. Instead it can use each subnet's gateway IP address.

Also in core Neutron there is an IP library module that provides methods for creating certain types of Linux network interfaces. networking-calico's interface driver uses a 'dummy' interface as the placeholder for Dnsmasq's DHCP context information and for the subnet prefix, but the IP library does not yet support the creation of such dummy interfaces. For consistency, therefore, it also makes sense to enhance the IP library so that it supports creation of dummy interfaces.

Please note that, although much work remains to define how routed networking is represented in the Neutron API and data model, there are two reasons why it makes sense to proceed with these DHCP agent and IP library changes now.

The Neutron-technical reasons is this: whatever API we end up with for routed networking, the DHCP agent code will need to be able to provide DHCP service to unbridged TAP interfaces, just as this bug describes; and the behaviour of the DHCP agent code is not actually driven by API properties, but by a config-defined interface driver. Therefore, when the API for routed networking is decided, the changes covered by this bug will still be correct.

The pragmatic / OpenStack community reason is that we (meaning the Calico project) already have several operators interested in and trialling this form of connectivity (even if it means accepting some semantic departures from the current Neutron API), and it will be a major help to both them and us if it is possible, as of the Liberty release, to do this with a vanilla Neutron release.

Changed in neutron:
assignee: nobody → Neil Jerram (neil-jerram)
Revision history for this message
Brian Haley (brian-haley) wrote :
Revision history for this message
Nell Jerram (neil-jerram) wrote :

Thanks for your comment and links, Brian. I plan to update those reviews to have this bug ID instead of that of https://launchpad.net/bugs/1472704.

I've also tried to catch Kyle to request his view, but think this week is super-busy for him. So I hope now that this RFE might be discussed, and hopefully approved for Liberty, at the next neutron-drivers meeting on Tuesday.

Changed in neutron:
status: New → In Progress
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Related fix merged to neutron (master)

Reviewed: https://review.openstack.org/205181
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=43d62c62a8525a1f2aa67b0ee201c09409fefa9a
Submitter: Jenkins
Branch: master

commit 43d62c62a8525a1f2aa67b0ee201c09409fefa9a
Author: Neil Jerram <email address hidden>
Date: Thu Jul 23 18:17:12 2015 +0100

    DHCP agent: clarify logic of setup_dhcp_port

    When the DHCP port already exists, the code for finding it is
    unhelpfully mixed up with the code for updating its subnet IDs and
    fixed IP addresses. Clarify that area by splitting setup_dhcp_port
    into 3 subroutines, for each of the existing, reserved and new port
    cases.

    Related-Bug: #1486649
    Change-Id: I2a537560dc7a37299f4b7b4cd508d9309bbe1209

Revision history for this message
Carl Baldwin (carl-baldwin) wrote :

I'm okay targeting Liberty-3 for this. I think we need a round or two of reviews but it shouldn't take too much away from the rest of Liberty-3.

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (master)

Reviewed: https://review.openstack.org/206079
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=e6708f6d47dc0bfdde3c9ced5066857c695ff717
Submitter: Jenkins
Branch: master

commit e6708f6d47dc0bfdde3c9ced5066857c695ff717
Author: Neil Jerram <email address hidden>
Date: Mon Jul 27 14:43:18 2015 +0100

    ip_lib: support creating Linux dummy interface

    This is for use by a DHCP agent interface driver in the
    networking-calico project. networking-calico connects VMs without
    using bridging, so it needs an unbridged DHCP port interface with
    which it can associate the DHCP subnet prefix, and the Linux dummy
    interface (in conjunction with use of Dnsmasq's --bridge-interface
    feature) is suitable for that purpose.

    Partial-Bug: #1486649
    Change-Id: I5485c187bc44bac3c2942c4fc9e5a502912a81a2

Kyle Mestery (mestery)
Changed in neutron:
importance: Undecided → Medium
milestone: none → liberty-3
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (feature/pecan)

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/218710

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (feature/pecan)
Download full text (155.6 KiB)

Reviewed: https://review.openstack.org/218710
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=2c5f44e1b3bd4ed8a0b7232fd293b576cc8c1c87
Submitter: Jenkins
Branch: feature/pecan

commit f35d1c5c50dccbef1a2e079f967b82f0df0e22e9
Author: Adelina Tuvenie <email address hidden>
Date: Thu Aug 27 02:27:28 2015 -0700

    Fixes wrong neutron Hyper-V Agent name in constants

    Change Id03fb147e11541be309c1cd22ce27e70fadc28b5 moved the
    AGENT_TYPE_HYPERV constant from common.constants to
    plugins.ml2.drivers.hyperv.constants but change the value of the
    constant from 'HyperV agent' to 'hyperv'. This patch changes
    the name back to 'HyperV agent'

    Change-Id: If74b4b2a84811e266c8b12e70bf6bfe74ed4ea21
    Partial-Bug: #1487598

commit de604de334854e2eb6b4312ff57920564cbd4459
Author: OpenStack Proposal Bot <email address hidden>
Date: Sun Aug 30 01:39:06 2015 +0000

    Updated from global requirements

    Change-Id: Ie52aa3b59784722806726e4046bd07f4a4d97328

commit f0415ac20eaf5ab4abb9bd4839bf6d04ceee85d0
Author: armando-migliaccio <email address hidden>
Date: Fri Aug 28 13:53:04 2015 -0700

    Revert "Add support for unaddressed port"

    This implementation may expose a vulnerability where a malicious
    user can sieze the opportunity of a time window where a port
    may land unaddressed on a shared network, thus allowing him/her
    to suck up all the tenant traffic he/she wants....oh the shivers.

    This reverts commit d4c52b7f5a36a103a92bf9dcda7f371959112292.

    Change-Id: I7ebdaa8d3defa80eab90e460fde541a5bdd8864c

commit 013fdcd2a6d45dbe4de5d6e7077e5e9b60985ef9
Author: Assaf Muller <email address hidden>
Date: Fri Aug 28 16:41:07 2015 -0400

    Improve logging upon failure in iptables functional tests

    This will help us nail down a more accurate and efficient logstash
    query.

    Change-Id: Iee4238e358f7b056e373c7be8d6aa3202117a680
    Related-Bug: #1478847

commit 622dea818d851224a43d5276a81d5ce8a6eebb76
Author: Ivar Lazzaro <email address hidden>
Date: Mon Aug 17 17:17:42 2015 -0700

    handle gw_info outside of the db transaction on router creation

    Move the gateway interface creation outside the DB transaction
    to avoid lock timeout.

    Change-Id: I5a78d7f32e8ca912016978105221d5f34618af19
    Closes-bug: 1485809

commit 5b27d290a0a95f6247fc5a0fe6da1e7d905e6b2d
Author: Assaf Muller <email address hidden>
Date: Wed Aug 26 10:07:03 2015 -0400

    Remove ml2 resource extension success logging

    This is the cause of a tremendous amount of logs, for no
    perceivable gain. A normal dvr run in the gate shows this debug
    message around 120K times, which is way too much.

    Closes-Bug: #1489952

    Change-Id: I26fca8515d866a7cc1638d07fa33bc04479ae221

commit 8d3faf549cba2f58c872ef4121b2481e73464010
Author: huangpengtao <email address hidden>
Date: Fri Aug 28 23:20:46 2015 +0800

    Replace "prt" variable by "port"

    the local variable prt is meaningless,
    and port is used popular.

    Change-Id: I20849102cf5b4d84433c46791b4b1e2a22dc4739

commit ee374e7a5f4dea538fcd942f5...

tags: added: in-feature-pecan
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (master)

Reviewed: https://review.openstack.org/206077
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=298d225e2962d41ae08f2777facc938a84bf4ef9
Submitter: Jenkins
Branch: master

commit 298d225e2962d41ae08f2777facc938a84bf4ef9
Author: Neil Jerram <email address hidden>
Date: Mon Jul 27 14:26:59 2015 +0100

    DHCP agent: add 'bridged' property to interface driver

    This allows a custom interface driver to use the reference DHCP agent
    to provide DHCP service to unbridged TAP interfaces, by overriding the
    definition of the property as follows.

        @property
        def bridged(self):
            return False

    Partial-Bug: #1486649
    Change-Id: I2c6bbd9df6833a65088173b021790eb23e64616b

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (feature/pecan)

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/219156

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (feature/pecan)
Download full text (3.8 KiB)

Reviewed: https://review.openstack.org/219156
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=22188bb0d96b05e9e2a8eb6ed73b18b6d36fc2ac
Submitter: Jenkins
Branch: feature/pecan

commit 1ec34b7d0d38324053996394be90d6fdecfed3ef
Author: Nick <email address hidden>
Date: Wed Aug 26 18:16:14 2015 +0800

    Linuxbridge-agent: fix bridge deletion

    Make sure that linuxbridge agent doesn't delete
    physical interfaces if they are specified in the
    physical_interface_mappings.

    Change-Id: I95e3c46b03ba2ae0872f5def47f26d4e8ea13094
    Closes-Bug: #1334634

commit 6324f7f23d5debecf7201a371050e20527550a8c
Author: Kevin Benton <email address hidden>
Date: Sun Aug 30 19:15:27 2015 -0700

    Fix usage of netaddr '.broadcast'

    netaddr 0.7.16 changed the behavior of IPNetworks with /31 and /32
    prefixes to make their 'broadcast' attribute return None. This patch
    replaces the use of the attribute with a -1 index lookup to get the
    last address instead.

    Closes-Bug: #1490380
    Change-Id: I97d71c4051882ddd9e496c78cfbce840ad7a2b67

commit 8a588dc95ef6486f3d28706052ca8873210d32f7
Author: Neil Jerram <email address hidden>
Date: Mon Aug 31 11:16:24 2015 +0100

    Add lieutenants contact for networking-calico

    Change-Id: Idc688a380e82ea6a385efc7b459b46e2daed0b4a

commit 81c2a7787fc6991db3fd3550f803e60994a7689a
Author: Neil Jerram <email address hidden>
Date: Mon Aug 31 11:10:53 2015 +0100

    Adding networking-calico to sub_projects document

    Change-Id: I537936dcc1723c76c12e816ff04645abaa7a8431

commit bac73541f420d1802cdf48f4d35b3a6ad1f5b7ee
Author: Ihar Hrachyshka <email address hidden>
Date: Mon Aug 24 17:58:12 2015 +0200

    [neutron-db-manage] Introduce contract and expand commands

    Those are just wrappers that pass proper @head revision into upgrade
    alembic API.

    Change-Id: I4d7e1bd992c3ad75fca6d72defa9f96565ad6ba9
    Partially-Implements: blueprint online-schema-migrations

commit 298d225e2962d41ae08f2777facc938a84bf4ef9
Author: Neil Jerram <email address hidden>
Date: Mon Jul 27 14:26:59 2015 +0100

    DHCP agent: add 'bridged' property to interface driver

    This allows a custom interface driver to use the reference DHCP agent
    to provide DHCP service to unbridged TAP interfaces, by overriding the
    definition of the property as follows.

        @property
        def bridged(self):
            return False

    Partial-Bug: #1486649
    Change-Id: I2c6bbd9df6833a65088173b021790eb23e64616b

commit cf003af20906f3ef556a39d4f4f7067193dbfb68
Author: Moshe Levi <email address hidden>
Date: Tue Aug 18 23:10:05 2015 +0300

    SR-IOV: deprecate agent_required option

    When SR-IOV introduce in Juno Agent supported only link state change
    Some Intel cards don't support setting link state, so to
    resolve it the SR-IOV mech driver supports agent and agent less mode.
    From Liberty the SR-IOV agent brings more functionality like
    qos and port security so we want to make the agent mandatory.
    (of course I already talked with Intel Guys to get their approval)

    This patch deprec...

Read more...

Changed in neutron:
importance: Medium → High
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (master)

Reviewed: https://review.openstack.org/206078
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=f3f5940201a9e010c188f83aead7d93e7e8c9b6d
Submitter: Jenkins
Branch: master

commit f3f5940201a9e010c188f83aead7d93e7e8c9b6d
Author: Neil Jerram <email address hidden>
Date: Mon Jul 27 14:41:29 2015 +0100

    DHCP agent: allow using gateway IPs instead of uniquely allocated

    In each place where the DHCP agent runs, and for each subnet for which
    DHCP is handing out IP addresses, the DHCP port needs - at the Linux
    level - to have an IP address within that subnet. Generally this
    needs to be a unique Neutron-allocated IP address, because the
    subnet's underlying L2 domain is bridged across multiple compute hosts
    and network nodes, and for HA there may be multiple DHCP agents
    running on that same bridged L2 domain.

    However, if the DHCP ports - on multiple compute/network nodes but for
    the same network - are _not_ bridged to each other, they do not need
    each to have a unique IP address. Instead they can all share the same
    address from the relevant subnet. This works, without creating any
    ambiguity, because those ports are not all present on the same L2
    domain, and because no data within the network is ever sent to that
    address. (DHCP requests are broadcast, and it is the network's job to
    ensure that such a broadcast will reach at least one of the available
    DHCP servers. DHCP responses will be sent _from_ the DHCP port
    address.)

    Specifically, for some networking backends it makes sense to allow all
    DHCP ports to use the subnet's gateway IP address, and thereby to
    completely avoid any unique IP address allocation.

    This change therefore enhances the DHCP agent code to be able to use
    gateway IPs as an alternative to uniquely allocated ones, with the
    choice between those being made by a new interface driver property,
    'use_gateway_ips'. The back-compatible default is to use unique IPs.
    An interface driver that wants the DHCP agent to use gateway IPs can
    achieve that by overriding as follows:

        @property
        def use_gateway_ips(self):
            return True

    Partial-Bug: #1486649
    Change-Id: I17e1dc9231a5ec35bd6f84c4c7aca6350d76e8ec

Changed in neutron:
status: In Progress → Fix Committed
Thierry Carrez (ttx)
Changed in neutron:
status: Fix Committed → Fix Released
Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix proposed to neutron (feature/pecan)

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/224334

Revision history for this message
OpenStack Infra (hudson-openstack) wrote :

Fix proposed to branch: feature/pecan
Review: https://review.openstack.org/224357

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Fix merged to neutron (feature/pecan)
Download full text (73.6 KiB)

Reviewed: https://review.openstack.org/224357
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=fdc3431ccd219accf6a795079d9b67b8656eed8e
Submitter: Jenkins
Branch: feature/pecan

commit fe236bdaadb949661a0bfb9b62ddbe432b4cf5f1
Author: Miguel Angel Ajo <email address hidden>
Date: Thu Sep 3 15:40:12 2015 +0200

    No network devices on network attached qos policies

    Network devices, like internal router legs, or dhcp ports
    should not be affected by bandwidth limiting rules.

    This patch disables application of network attached policies
    to network/neutron owned ports.

    Closes-bug: #1486039
    DocImpact

    Change-Id: I75d80227f1e6c4b3f5fa7762b8dc3b0c0f1abd46

commit db4a06f7caa20a4c7879b58b20e95b223ed8eeaf
Author: Ken'ichi Ohmichi <email address hidden>
Date: Wed Sep 16 10:04:32 2015 +0000

    Use tempest-lib's token_client

    Now tempest-lib provides token_client modules as library and the
    interface is stable. So neutron repogitory doesn't need to contain
    these modules.
    This patch makes neutron use tempest-lib's token_client and removes
    the own modules for the maintenance.

    Change-Id: Ieff7eb003f6e8257d83368dbc80e332aa66a156c

commit 78aed58edbe6eb8a71339c7add491fe9de9a0546
Author: Jakub Libosvar <email address hidden>
Date: Thu Aug 13 09:08:20 2015 +0000

    Fix establishing UDP connection

    Previously, in establish_connection() for UDP protocol data were sent
    but never read on peer socket. That lead to successful read on peer side
    if this connection was filtered. Having constant testing string masked
    this issue as we can't distinguish to which test of connectivity data
    belong.

    This patch makes unique data string per test_connectivity() and
    also makes establish_connection() to create an ASSURED entry in
    conntrack table. Finally, in last test after firewall filter was
    removed, connection is re-established in order to avoid troubles with
    terminated processes or TCP continuing sending packets which weren't
    successfully delivered.

    Closes-Bug: 1478847
    Change-Id: I2920d587d8df8d96dc1c752c28f48ba495f3cf0f

commit e6292fcdd6262434a7b713ad8802db6bc8a6d3dc
Author: YAMAMOTO Takashi <email address hidden>
Date: Wed Sep 16 13:20:51 2015 +0900

    ovsdb: Fix a few docstring

    Change-Id: I53e1e21655b28fe5da60e58aeeb7cbbd103ae014

commit c22949a4449d96a67caa616290cf76b67b182917
Author: fumihiko kakuma <email address hidden>
Date: Wed Sep 16 11:52:59 2015 +0900

    Remove requirements.txt for the ofagent mechanism driver

    It is no longer used.

    Related-Blueprint: core-vendor-decomposition
    https://blueprints.launchpad.net/neutron/+spec/core-vendor-decomposition

    Change-Id: Ib31fb3febf8968e50d86dd66e1e6e1ea2313f8ac

commit d1d4de19d85f961d388c91e70f31b3bafec418c5
Author: Kevin Benton <email address hidden>
Date: Thu Sep 3 20:25:57 2015 -0700

    Always return iterables in L3 get_candidates

    The caller of this function expects iterables.

    Closes-Bug: #1494996
    Change-Id: I3d103e63f4e127a77268502415c0ddb0d804b54a

commit 1ad6ac448067306...

Revision history for this message
OpenStack Infra (hudson-openstack) wrote : Change abandoned on neutron (feature/pecan)

Change abandoned by Doug Wiegley (<email address hidden>) on branch: feature/pecan
Review: https://review.openstack.org/224334

Thierry Carrez (ttx)
Changed in neutron:
milestone: liberty-3 → 7.0.0
Revision history for this message
Nell Jerram (neil-jerram) wrote :

Same comment/question here as I just asked for https://bugs.launchpad.net/neutron/+bug/1478190:

I don't yet fully understand the OpenStack bug process, so asking what may be a rather basic question:

Do I (as the assignee, and fixer) need to do something explicit to close this bug down? From my point, the fixes are done and released, and nothing further is needed, so the bug could potentially now be closed.

Thanks!

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.