Can't use nova when configuring neutron.agent.firewall.NoopFirewallDriver in neutron plugins

[Xiang Hui]

OS : RHEL6.4
OpenStack version : Havana

If setting "firewall_driver = neutron.agent.firewall.NoopFirewallDriver" in vi /etc/neutron/plugins/openvswitch/ovs_neutron_plugin.ini, some functions of Nova are lost.

[root@oxianghui v2_0]# nova list
ERROR: The server has either erred or is incapable of performing the requested operation. (HTTP 500) (Request-ID: req-7c2bc0a7-e413-48e9-9865-d743d5ab0497)

The error log:

2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack Traceback (most recent call last):
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/nova/api/openstack/__init__.py", line 112, in __call__
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack return req.get_response(self.application)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/webob/request.py", line 1296, in send
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack application, catch_exc_info=False)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/webob/request.py", line 1260, in call_application
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack app_iter = application(self.environ, start_response)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/webob/dec.py", line 144, in __call__
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack return resp(environ, start_response)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/keystoneclient/middleware/auth_token.py", line 539, in __call__
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack return self.app(env, start_response)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/webob/dec.py", line 144, in __call__
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack return resp(environ, start_response)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/webob/dec.py", line 144, in __call__
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack return resp(environ, start_response)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/routes/middleware.py", line 131, in __call__
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack response = self.app(environ, start_response)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/webob/dec.py", line 144, in __call__
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack return resp(environ, start_response)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/webob/dec.py", line 130, in __call__
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack resp = self.call_func(req, *args, **self.kwargs)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/webob/dec.py", line 195, in call_func
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack return self.func(req, *args, **kwargs)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/nova/api/openstack/wsgi.py", line 912, in __call__
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack content_type, body, accept)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/nova/api/openstack/wsgi.py", line 997, in _process_stack
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack request, action_args)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/nova/api/openstack/wsgi.py", line 885, in post_process_extensions
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack **action_args)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/nova/api/openstack/compute/contrib/security_groups.py", line 583, in detail
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack self._extend_servers(req, list(resp_obj.obj['servers']))
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/nova/api/openstack/compute/contrib/security_groups.py", line 533, in _extend_servers
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack .get_instances_security_groups_bindings(context))
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/nova/network/security_group/neutron_driver.py", line 288, in get_instances_security_groups_bindings
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack security_groups = neutron.list_security_groups().get('security_groups')
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/neutronclient/v2_0/client.py", line 108, in with_params
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack ret = self.function(instance, *args, **kwargs)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/neutronclient/v2_0/client.py", line 468, in list_security_groups
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack security_groups = self.list('security_groups',
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/neutronclient/v2_0/client.py", line 1199, in list
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack headers=headers, params=params)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/neutronclient/v2_0/client.py", line 1212, in _pagination
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack linkrel = 'previous'
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/neutronclient/v2_0/client.py", line 1185, in get
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack return self.retry_request("DELETE", action, body=body,
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/neutronclient/v2_0/client.py", line 1170, in retry_request
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack """
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/neutronclient/v2_0/client.py", line 1113, in do_request
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack httplib.CREATED,
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/neutronclient/v2_0/client.py", line 1083, in _handle_fault_response
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack except Exception:
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack File "/usr/lib/python2.6/site-packages/neutronclient/v2_0/client.py", line 88, in exception_handler_v20
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack message=message)
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack NeutronClientException: 404 Not Found
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack
2013-09-29 07:23:08.200 7666 TRACE nova.api.openstack The resource could not be found.

The root cause is that the extension of security groups is not loaded if setting "firewall_driver = neutron.agent.firewall.NoopFirewallDriver" in neutron, the python-neutronclient will raise an exception as "Not Found".
Nova have referred the function "list_security_groups" of neutron in some functions.
I think Nova should be independent with Neutron as a OpenStack module.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/48879

[ChangBo Guo(gcb) (glongwave)]

In this situation : nova list /boot/ show will fail due to getting NeutronClientException raised by neturon client.

[Matt Riedemann (mriedem)]

The neutronclient patch was abandoned and the nova patch is here: https://review.openstack.org/#/c/52597/

[ChangBo Guo(gcb) (glongwave)]

After talk with Akihiro Motoki
1) create instance with security_group.2)then set firewall to disable it . 3) run command nova show/list.
This is not valid test Scenario.

We should always enable or disable neutron security_groups.

[Sheldon Hearn (sheldonh)]

The RHEL/Centos/Fedora install guide currently leads you to this bug:

"Regardless of which firewall driver you chose when you configure the network and compute nodes, set this driver as the No-Op firewall. The difference is that this is a Nova firewall, and because Neutron handles the Firewall, you must tell Nova not to use one."

http://docs.openstack.org/havana/install-guide/install/apt/content/install-neutron.dedicated-controller-node.html

Looks like a show stopper to me.

[Sheldon Hearn (sheldonh)]

It's a bug in the install guide: http://docs.openstack.org/havana/install-guide/install/apt/content/install-neutron.install-plug-in-controller.ovs.gre.html#comment-1132665540

[Xiang Hui (xianghui)]

Thanks Sheldon for your effort, I think this bug should be reset to valid to give an obvious indication in the install guide,
or users and operator may feel frustrated about the security group.

[Xiang Hui (xianghui)]

https://review.openstack.org/#/c/57842/

[Xiang Hui (xianghui)]

https://review.openstack.org/#/c/58212/

[Sean Dague (sdague)]

The last real action on this bug was 3 years ago, closing

[OpenStack Infra (hudson-openstack)]

This issue was fixed in the openstack/openstack-manuals 15.0.0 release.