os-vif 1.15.0 added the ability to create an OVS port during plugging
by specifying the 'create_port' attribute in the 'port_profile' field.
By delegating port creation to os-vif, we can rely on it's 'isolate_vif'
config option [1] that will temporarily configure the VLAN to 4095
(0xfff), which is reserved for implementation use [2] and is used by
neutron to as a dead VLAN [3]. By doing this, we ensure VIFs are plugged
securely, preventing guests from accessing other tenants' networks
before the neutron OVS agent can wire up the port.
This change requires a little dance as part of the live migration flow.
Since we can't be certain the destination host has a version of os-vif
that supports this feature, we need to use a sentinel to indicate when
it does. Typically we would do so with a field in
'LibvirtLiveMigrateData', such as the 'src_supports_numa_live_migration'
and 'dst_supports_numa_live_migration' fields used to indicate support
for NUMA-aware live migration. However, doing this prevents us
backporting this important fix since o.vo changes are not backportable.
Instead, we (somewhat evilly) rely on the free-form nature of the
'VIFMigrateData.profile_json' string field, which stores JSON blobs and
is included in 'LibvirtLiveMigrateData' via the 'vifs' attribute, to
transport this sentinel. This is a hack but is necessary to work around
the lack of a free-form "capabilities" style dict that would allow us do
backportable fixes to live migration features.
Note that this change has the knock on effect of modifying the XML
generated for OVS ports: when hybrid plug is false will now be of type
'ethernet' rather than 'bridge' as before. This explains the larger than
expected test damage but should not affect users.
NOTE(stephenfin): Change I362deb1088c88cdcd8219922da9dc9a01b10a940
("objects: Fix VIFMigrateData.supports_os_vif_delegation setter") which
contains an important fix for the original change, is squashed into this
change. In addition, the os-vif version bump we introduced in the
original version of this patch is not backportable and as a result, we
must introduce two additional checks. Both checks ensure we have a
suitable version of os-vif and skip the new code paths if not. The first
check is in the libvirt driver's 'check_can_live_migrate_destination'
function, which as the name suggests runs on the destination host early
in the live migration process. If os-vif is not new enough on the
destination, we will report that we cannot support os-vif delegation.
The other check is in the '_nova_to_osvif_vif_ovs' helper in
'nova.network.os_vif_util'. This simply ensures we don't try to set an
invalid attribute on the os-vif object if the version isn't new enough.
Two tests are modified to accommodate these checks with similar version
check logic. The lower-constraints job can be relied on to validate
behavior on the older version of os-vif.
Reviewed: https:/ /review. opendev. org/c/openstack /nova/+ /790447 /opendev. org/openstack/ nova/commit/ 23a4b27dc0c156a d6cbe5260d518da 3fd62294b8
Committed: https:/
Submitter: "Zuul (22348)"
Branch: stable/wallaby
commit 23a4b27dc0c156a d6cbe5260d518da 3fd62294b8
Author: Stephen Finucane <email address hidden>
Date: Fri Apr 30 12:51:35 2021 +0100
libvirt: Delegate OVS plug to os-vif
os-vif 1.15.0 added the ability to create an OVS port during plugging
by specifying the 'create_port' attribute in the 'port_profile' field.
By delegating port creation to os-vif, we can rely on it's 'isolate_vif'
config option [1] that will temporarily configure the VLAN to 4095
(0xfff), which is reserved for implementation use [2] and is used by
neutron to as a dead VLAN [3]. By doing this, we ensure VIFs are plugged
securely, preventing guests from accessing other tenants' networks
before the neutron OVS agent can wire up the port.
This change requires a little dance as part of the live migration flow. eMigrateData' , such as the 'src_supports_ numa_live_ migration' numa_live_ migration' fields used to indicate support Data.profile_ json' string field, which stores JSON blobs and rateData' via the 'vifs' attribute, to
Since we can't be certain the destination host has a version of os-vif
that supports this feature, we need to use a sentinel to indicate when
it does. Typically we would do so with a field in
'LibvirtLiv
and 'dst_supports_
for NUMA-aware live migration. However, doing this prevents us
backporting this important fix since o.vo changes are not backportable.
Instead, we (somewhat evilly) rely on the free-form nature of the
'VIFMigrate
is included in 'LibvirtLiveMig
transport this sentinel. This is a hack but is necessary to work around
the lack of a free-form "capabilities" style dict that would allow us do
backportable fixes to live migration features.
Note that this change has the knock on effect of modifying the XML
generated for OVS ports: when hybrid plug is false will now be of type
'ethernet' rather than 'bridge' as before. This explains the larger than
expected test damage but should not affect users.
Changes: constraints. txt nts.txt network/ os_vif_ util.py tests/unit/ virt/libvirt/ test_vif. py tests/unit/ virt/libvirt/ test_driver. py virt/libvirt/ driver. py
lower-
requireme
nova/
nova/
nova/
nova/
NOTE( stephenfin) : Change I362deb1088c88c dcd8219922da9dc 9a01b10a940 supports_ os_vif_ delegation setter") which can_live_ migrate_ destination' to_osvif_ vif_ovs' helper in network. os_vif_ util'. This simply ensures we don't try to set an
("objects: Fix VIFMigrateData.
contains an important fix for the original change, is squashed into this
change. In addition, the os-vif version bump we introduced in the
original version of this patch is not backportable and as a result, we
must introduce two additional checks. Both checks ensure we have a
suitable version of os-vif and skip the new code paths if not. The first
check is in the libvirt driver's 'check_
function, which as the name suggests runs on the destination host early
in the live migration process. If os-vif is not new enough on the
destination, we will report that we cannot support os-vif delegation.
The other check is in the '_nova_
'nova.
invalid attribute on the os-vif object if the version isn't new enough.
Two tests are modified to accommodate these checks with similar version
check logic. The lower-constraints job can be relied on to validate
behavior on the older version of os-vif.
[1] https:/ /opendev. org/openstack/ os-vif/ src/tag/ 2.4.0/vif_ plug_ovs/ ovs.py# L90-L93 /en.wikipedia. org/wiki/ IEEE_802. 1Q#Frame_ format /answers. launchpad. net/neutron/ +question/ 231806
[2] https:/
[3] https:/
NOTE(auniyal): /github. com/openstack/ nova/commit/ fa0fb2fe3d61de1 cb871c48ee97053 cf2fb5827a Domain. XMLDesc to add pci address /github. com/openstack/ nova/commit/ 1ad287bf9a8f65c e68c14f4634775f 58abda15c2
* libvirt: Always delegate OVS plug to os-vif is squashed
https:/
* Updated fakelibvirt.
for ovs interface, which is a patial backport of
https:/
Change-Id: I11fb5d3ada7f27 b39c183157ea73c 8b72b4e672e ac8ad9ef2b3641d a1b79a25a50 ab128e558e127d7 6962738446)
Depends-On: Id12486b3127ab4
Closes-Bug: #1734320
Closes-Bug: #1815989
(cherry picked from commit a62dd42c0dbb6b2