Octavia creates at least 2 ports for each load balancer:
- the VIP port, it is down, it keeps/stores the IP address of the LB
- the VRRP port, plugged into a VM, it has the VIP address in the allowed-address list (and the VIP address is configured on the interface in the VM)
When sending an ARP request for the VIP address, the VRRP port should reply with its mac-address.
In OVN the VIP port is marked as "type: virtual".
But when the VIP port is updated, it loses its "port: virtual" status and that breaks the ARP resolution (OVN replies to the ARP request by sending the mac-address of the VIP port - which is not used/down).
Quick reproducer that simulates the Octavia behavior:
if 'type: virtual' not in output:
print("Port is not virtual, this is an issue.")
print(output)
===========================
In my env (devstack master on c9s):
$ python3 /mnt/host/virtual_port_issue.py
Port is virtual, this is ok.
port e0fe2894-e306-42d9-8c5e-6e77b77659e2 (aka lb-vip)
type: virtual
addresses: ["fa:16:3e:93:00:8f 172.24.4.111 2001:db8::178"]
Port is not virtual, this is an issue.
port e0fe2894-e306-42d9-8c5e-6e77b77659e2 (aka lb-vip)
addresses: ["fa:16:3e:93:00:8f 172.24.4.111 2001:db8::178"]
port 8ec36278-82b1-436b-bc5e-ea03ef22192f
In Octavia, the "port: virtual" is _sometimes_ back after other updates of the ports, but in some cases the LB is unreachable.
(and "ovn-nbctl lsp-set-type <vip-port-id> virtual" fixes the LB)
Bug found in Octavia (master)
Octavia creates at least 2 ports for each load balancer:
- the VIP port, it is down, it keeps/stores the IP address of the LB
- the VRRP port, plugged into a VM, it has the VIP address in the allowed-address list (and the VIP address is configured on the interface in the VM)
When sending an ARP request for the VIP address, the VRRP port should reply with its mac-address.
In OVN the VIP port is marked as "type: virtual".
But when the VIP port is updated, it loses its "port: virtual" status and that breaks the ARP resolution (OVN replies to the ARP request by sending the mac-address of the VIP port - which is not used/down).
Quick reproducer that simulates the Octavia behavior:
======= ======= ======= ======
import subprocess
import time
import openstack
conn = openstack. connect( cloud=" devstack- admin-demo" )
network = conn.network. find_network( "public" )
sg = conn.network. find_security_ group(' sg') create_ security_ group(name= 'sg')
if not sg:
sg = conn.network.
vip_port = conn.network. create_ port( id=network. id, id="lb- 1", owner=" me", admin_state_ up=False)
name="lb-vip",
network_
device_
device_
is_
vip_address = [ ip['ip_ address' ] 'ip_address' ]][0]
fixed_
for fixed_ip in vip_port.fixed_ips
if '.' in fixed_ip[
vrrp_port = conn.network. create_ port( id="vrrp" , owner=" vm", id=network. id) update_ port( address_ pairs=[
{"ip_address" : vip_address,
"mac_ address" : vrrp_port. mac_address} ])
name="lb-vrrp",
device_
device_
network_
vrrp_port = conn.network.
vrrp_port,
allowed_
time.sleep(1)
output = subprocess. check_output( decode( 'utf-8' )
f"sudo ovn-nbctl show | grep -A2 'port {vip_port.id}'",
shell=True)
output = output.
if 'type: virtual' in output:
print("Port is virtual, this is ok.")
print(output)
conn.network. update_ port( group_ids= [sg.id] )
vip_port,
security_
time.sleep(1)
output = subprocess. check_output( decode( 'utf-8' )
f"sudo ovn-nbctl show | grep -A2 'port {vip_port.id}'",
shell=True)
output = output.
if 'type: virtual' not in output:
print("Port is not virtual, this is an issue.")
print(output)
======= ======= ======= ======
In my env (devstack master on c9s): virtual_ port_issue. py e306-42d9- 8c5e-6e77b77659 e2 (aka lb-vip)
$ python3 /mnt/host/
Port is virtual, this is ok.
port e0fe2894-
type: virtual
addresses: ["fa:16:3e:93:00:8f 172.24.4.111 2001:db8::178"]
Port is not virtual, this is an issue. e306-42d9- 8c5e-6e77b77659 e2 (aka lb-vip) 82b1-436b- bc5e-ea03ef2219 2f
port e0fe2894-
addresses: ["fa:16:3e:93:00:8f 172.24.4.111 2001:db8::178"]
port 8ec36278-
In Octavia, the "port: virtual" is _sometimes_ back after other updates of the ports, but in some cases the LB is unreachable.
(and "ovn-nbctl lsp-set-type <vip-port-id> virtual" fixes the LB)