[OVN] Error 400 when creating stateless SG [Unrecognized attribute(s) 'stateful']

[Ammad Ali]

Hi,

I am using neutron 19.0.0 with ovn 21.09 and ovs 2.16.0. I am trying to create a stateless security group with openstack python3 neutron client but its showing below error.

# openstack security group create --stateless sec02-stateless
Error while executing command: BadRequestException: 400, Unrecognized attribute(s) 'stateful'

In neutron logs I see stateful-security-group in neutron logs is not loaded.

## Showing nothing
# neutron ext-list | grep stateful-security-group

# grep stateful-security-group neutron-server.log

2021-11-02 13:02:20.846 998 DEBUG neutron.api.extensions [req-b022ced2-f365-4ab9-9f61-25e915231e02 - - - - -] Ext name="Stateful security group" alias="stateful-security-group" description="Indicates if the security group is stateful or not" updated="2019-11-26T09:00:00-00:00" _check_extension /usr/lib/python3/dist-packages/neutron/api/extensions.py:416
2021-11-02 13:02:20.846 998 INFO neutron.api.extensions [req-b022ced2-f365-4ab9-9f61-25e915231e02 - - - - -] Extension stateful-security-group not supported by any of loaded plugins

I have added stateful-security-group extension in neutron/common/ovn/extensions.py and SG creation goes successful.

[Rodolfo Alonso (rodolfo-alonso-hernandez)]

Hi Ammand:

As you found the problem and tested the solution, will you push a patch? If not, ping me to do it.

Thank you and regards.

[Rodolfo Alonso (rodolfo-alonso-hernandez)]

For documentation purposes, related bug: https://bugs.launchpad.net/neutron/+bug/1885262. That bug implemented this feature in Neutron.

[Ammad Ali (syedammad83)]

Hi Alonso,

I am new to openstack contribution and reviewing contribution guide. It will take some time. Its better you just push a quick fix in master and backport it to xena.

[Ihar Hrachyshka (ihar-hrachyshka)]

Thanks for the report, surprised it's not enabled, I probably missed it from inclusion when uploading the final version for review. Evidently we need tempest tests for this...

[Lajos Katona (lajos-katona)]

Seems the bot didn't added the link:
https://review.opendev.org/c/openstack/neutron/+/816612

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/816614
Committed: https://opendev.org/openstack/neutron/commit/753693d315a79c84eabd3fd21f2b6f3f5bcef23f
Submitter: "Zuul (22348)"
Branch: master

commit 753693d315a79c84eabd3fd21f2b6f3f5bcef23f
Author: Ihar Hrachyshka <email address hidden>
Date: Thu Nov 4 03:16:55 2021 +0000

    Bump OVN version for functional job to 21.06

    This is needed to validate allow-stateless with the job.

    Related-Bug: #1949451
    Change-Id: I2e3d389552aeb4f454b01fe69198d759c8b2a039

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/816612
Committed: https://opendev.org/openstack/neutron/commit/c95ccf0a43f8f40ed6988d88fae01b225b68b43e
Submitter: "Zuul (22348)"
Branch: master

commit c95ccf0a43f8f40ed6988d88fae01b225b68b43e
Author: Ihar Hrachyshka <email address hidden>
Date: Thu Nov 4 03:02:03 2021 +0000

    ovn: enable stateless-security-group api

    The feature is long implemented but the list of extensions was not
    updated accordingly. Because of missing tempest test cases for the
    field, it was not caught before.

    Closes-Bug: #1949451
    Change-Id: I85f7749e7e6186b9e3a7534bce6c306b18702333

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron-tempest-plugin/+/816613
Committed: https://opendev.org/openstack/neutron-tempest-plugin/commit/b0b597f803328b021474f1072f2cdeff9297391a
Submitter: "Zuul (22348)"
Branch: master

commit b0b597f803328b021474f1072f2cdeff9297391a
Author: Ihar Hrachyshka <email address hidden>
Date: Thu Nov 4 03:00:42 2021 +0000

    Add stateless security group test case

    It's a simple test case that creates, updates a stateless SG and
    checks that the attribute is updated accordingly.

    Related-Bug: #1949451
    Depends-On: I85f7749e7e6186b9e3a7534bce6c306b18702333
    Change-Id: I30e0a11c45618cbdaa0130942cb67ea99bbd0b92

[OpenStack Infra (hudson-openstack)]

Related fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/neutron/+/821439

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: stable/xena
Review: https://review.opendev.org/c/openstack/neutron/+/821441

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/821439
Committed: https://opendev.org/openstack/neutron/commit/cdf30d3e339567aab95e880c28fdde79a11c79fa
Submitter: "Zuul (22348)"
Branch: stable/xena

commit cdf30d3e339567aab95e880c28fdde79a11c79fa
Author: Ihar Hrachyshka <email address hidden>
Date: Thu Nov 4 03:16:55 2021 +0000

    Bump OVN version for functional job to 21.06

    This is needed to validate allow-stateless with the job.

    Related-Bug: #1949451
    Change-Id: I2e3d389552aeb4f454b01fe69198d759c8b2a039
    (cherry picked from commit 753693d315a79c84eabd3fd21f2b6f3f5bcef23f)

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.opendev.org/c/openstack/neutron/+/821441
Committed: https://opendev.org/openstack/neutron/commit/666562a258c00dc2cfcf6657ecb8343bc7703b75
Submitter: "Zuul (22348)"
Branch: stable/xena

commit 666562a258c00dc2cfcf6657ecb8343bc7703b75
Author: Ihar Hrachyshka <email address hidden>
Date: Thu Nov 4 03:02:03 2021 +0000

    ovn: enable stateless-security-group api

    The feature is long implemented but the list of extensions was not
    updated accordingly. Because of missing tempest test cases for the
    field, it was not caught before.

    Conflicts:
          neutron/common/ovn/extensions.py

    Closes-Bug: #1949451
    Change-Id: I85f7749e7e6186b9e3a7534bce6c306b18702333
    (cherry picked from commit c95ccf0a43f8f40ed6988d88fae01b225b68b43e)

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 20.0.0.0rc1 release candidate.

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/neutron 19.2.0 release.