[RFE] Allow to limit conntrack entries per tenant to avoid "nf_conntrack: table full, dropping packet"

[Alexey Stupnikov]

Description of problem:

A tenant can cause network issues for other tenants: nf_conntrack: table full, dropping packet.

In our cloud had a jmeter performance test running on two instances caused network issues for other tenants.

In the /var/log/messages on the compute node we see the following message:
"nf_conntrack: table full, dropping packet."

This gerrit https://review.openstack.org/#/c/275769/ increases the limit to 500.000 but this is a workaround as a tenant can still increase usage up to this new limit.

Neutron allows to limit bandwidth on a port, but you cannot limit the conntrack sessions for an instance, port or tenant.

RHBZ: https://bugzilla.redhat.com/show_bug.cgi?id=1399987

[Alexey Stupnikov (astupnikov)]

From linux/iptables perspective it looks like:

- nf_conntrack_max still works in previous fashion and doesn't support per-zone limits
- it is now possible to use iptables connlimit module to enforce limits per zone
- in Neutron code connlimit is not currently used

[yatin (yatinkarel)]

Thanks Alexey for the bug report.

From the linked RHBZ, i see for ml2/ovn support is required in core OVN[1], and this bug is just for ml2/ovs with iptables firewall?

This seems to be an RFE. Do you plan to work on the implementation, please raise this in Neutron Driver meeting.

[1] https://bugzilla.redhat.com/show_bug.cgi?id=2189924
[2] https://meetings.opendev.org/#Neutron_drivers_Meeting

[Alexey Stupnikov (astupnikov)]

@yatin. This is an RFE indeed and the focus here is ML2/OVS. I reported this LP after chat with Slaweq and had no plans to work on it.