[OVN] default setting leak nameserver config from the host to instances

[Dr. Jens Harbott]

Using the default settings, i.e. without [ovn]dns_servers being specified in ml2_conf.ini, OVN will send the nameserver addresses that are specified in /etc/resolv.conf on the host in DHCP responses. This may lead to unexpected leaks about the host infrastructure and thus should at least be well documented. In most cases it will also lead to broken DNS resolution for the instances, since when systemd-resolve is being used, the host's nameserver address will be 127.0.0.53, and an instance will not be able to resolve anything using that address.

Possibly a better approach would be to not send any nameserver information via DHCP in this scenario.

[Rodolfo Alonso (rodolfo-alonso-hernandez)]

Hello Jens:

This is the expected behaviour for OVN, as documented here [1]. When building the DHCP options, the DNS servers option is populated first with the subnet "dns_nameservers". If empty, the "OVN.dns_servers" option will be used. If empty, the OVN mech driver will use the local DNS resolver (reading from "/etc/resolv.conf") [2].

Admin/user can always provide a valid DNS nameserver if needed.

Regards.

[1]https://github.com/openstack/neutron/blob/90b5456b8c11011c41f2fcd53a8943cb45fb6479/neutron/conf/plugins/ml2/drivers/ovn/ovn_conf.py#L158-L164
[2]https://github.com/openstack/neutron/blob/90b5456b8c11011c41f2fcd53a8943cb45fb6479/neutron/plugins/ml2/drivers/ovn/mech_driver/ovsdb/ovn_client.py#L1916-L1918

[Dr. Jens Harbott (j-harbott)]

Hmm, o.k. the documentation in [1] is somewhere between misleading and wrong. "The nameserver addresses are used as forwarders" implies they are somehow used by OVN to resolve queries, instead they are simply sent to the instance in the DHCP options. Same for "the DNS resolvers on the host running the neutron server will be used." Maybe having some real document would be better than hiding this in the description of the configuration option.

Also, utils.get_system_dns_resolvers() might be made more intelligent to actually look at what systemd-resolve is using when 127.0.0.53 is found as nameserver. Simply not using that function and not setting the dns option in that case would still be my preferred solution.