creating a VM without IP (ip_allocation='none')

[Mathieu Rohon]

Using latest neutron [1] and python-neutronclient [2], we are now able to create VMs without IP addresses.

If I run :

$ openstack network create net1
$ openstack port create --network net1 --no-fixed-ip port_net1

I get the IP_allocation field equal to "none" in the neutron database for the created port.

So the following command should result in a VM without IP Addresses :

$ openstack server create --flavor 1 --image 78ee2490-3b59-4c1f-bc29-cdb878ccfc26 --port port_net1

Instead I have the following error :

Port c1013516-8e00-4f99-817d-07edbb386142 requires a FixedIP in order to be used. (HTTP 400)

It seems that nova only accepts VMs with deferred ip_allocation [3][4], not "none".

Accepting "none" as a valid option for the ip_allocation attribute would implement [5], as [4] was expected to, regarding Matt Riedemann last comment on [5].

[1] https://review.openstack.org/#/c/361455/
[2] https://review.openstack.org/#/c/504817/
[3] http://git.openstack.org/cgit/openstack/nova/tree/nova/network/neutronv2/api.py#n1663
[4] https://review.openstack.org/#/c/299591/
[5] https://review.openstack.org/#/c/239276/

[Mathieu Rohon (mathieu-rohon)]

As soon as the port-security as been disabled on the network, the following patch works fine on top of 21d7d4e20c89e8a8ae174b5a42b8bc388c3a95e6

We end up having a VM without an IP, correctly created by nova.

[Mathieu Rohon (mathieu-rohon)]

during my initial test, the ip_allocation was not activated on the neutron side.
Hence, the ip_allocation attribute of a port was not accessible over REST requests done by nova.

The only way to activate this extension with the neutron vanilla code seems to use the "segments" service plugin [1][2]

After adding the "segments" to the list of enabled service plugins in neutron.conf, nova can access the ip_allocation attribute of a port.

Then nova can check if the port's ip_allocation is set to 'none', and keep on creating the VM without raising an exception regarding the missing fixed ip.

This leads to the attached patch, that works in the context of :
- segment service plugin enabled in neutron;
- port_security disbaled on the port's network;

[1]https://docs.openstack.org/neutron/pike/contributor/internals/segments.html#
[2]https://github.com/openstack/neutron/blob/d505e3eeb7e4d3ee211499286fd050ed48fdbf96/neutron/services/segments/plugin.py

[Mathieu Rohon (mathieu-rohon)]

I've reported a related issue on Neutron, concerning the inconsistency of the ip_allocation attribute usage (can be set without "segments" service plugin enabled, but cannot be read)

https://bugs.launchpad.net/neutron/+bug/1742093

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/533249

[sean mooney (sean-k-mooney)]

not that ip_allocation=None was originally not supported intentornally
due to security concerns.

it was declared out of scope in
https://specs.openstack.org/openstack/nova-specs/specs/newton/implemented/neutron-routed-networks.html#proposed-change

i personaly am not confrotable treating this as jsut a bug fix without first checking
with the wider nova core team so i am not going to triage this as a valid bug untill i
discuss it futther on irc.

[do3meli (d-info-e)]

has there been any more progress on this? was the issue discussed with the wider nova core team?