LLDP daemon running on calico virtual interfaces

[Matt Peters]

Title
-----
LLDP daemon running on virtual interfaces

Brief Description
-----------------
The LLDP daemon (lldpd) is not configured to exclude the virtual interfaces in a containerized deployment and is therefore sending LLDP frames on these interfaces and is occasionally generating error logs and excessive network traffic within the system.

Severity
--------
Provide the severity of the defect.
Minor: System/Feature is usable with minor issue

Steps to Reproduce
------------------
1) Deploy StarlingX in a container deployment configuration (--kubernetes)
2) Launch a sample container image.

The default configuration of the LLDP daemon will start to transmit LLDP frames on any interfaces that are not explicitly configured to be excluded. The cali* virtual interfaces (veth) and tunl0 (ipip) tunnel interfaces will be used by the LLDP to send LLDP frames.

Expected Behavior
------------------
The container interfaces and the tunnel interfaces used by the Calico CNI should not be used in the LLDP topology discovery.

The target configuration should be something like the following.
# /etc/lldp.conf
configure system interface pattern *,!br*,!ovs*,!tap*,!docker*,!tunl*,!cali*

Actual Behavior
----------------
The LLDP daemon is sending LLDP frames on virtual interfaces.

Reproducibility
---------------
Reproducible - 100%

System Configuration
--------------------
All configurations.

Branch/Pull Time/Commit
-----------------------
###
### StarlingX
### Release 19.01
###

OS="centos"
SW_VERSION="19.01"
BUILD_TARGET="Host Installer"
BUILD_TYPE="Formal"
BUILD_ID="f/stein"

JOB="STX_build_stein_master"
<email address hidden>"
BUILD_NUMBER="44"
BUILD_HOST="starlingx_mirror"
BUILD_DATE="2019-02-07 18:00:27 +0000"

Timestamp/Logs
--------------
Provide a snippet of logs if available and the timestamp when issue was seen.
Please indicate the unique identifier in the logs to highlight the problem
Provide a pointer to the logs for debugging (use attachments in Launchpad or paste.openstack.org)

[Ghada Khalil (gkhalil)]

Marking as stx release gating as it would be nice to clean this up before the release milestone

[cheng li (chengli3)]

So the lldp frames are only supposed to be send via management interface and OAM interface, right?
Would need to send lldp frames via data interfaces?

[Ghada Khalil (gkhalil)]

We still need to keep lldp running on the data interfaces. This bug is to only exclude the lldp daemon from running on the virtual calico interfaces in a containerized deployment.

[cheng li (chengli3)]

https://review.openstack.org/#/c/639572/1

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/639572
Committed: https://git.openstack.org/cgit/openstack/stx-config/commit/?id=4229d6a1dc2d42a97f21976192a656569f7b43ad
Submitter: Zuul
Branch: master

commit 4229d6a1dc2d42a97f21976192a656569f7b43ad
Author: chengli3 <email address hidden>
Date: Wed Feb 27 14:11:29 2019 +0800

    Suppress lldp frames on virtual interfaces

    virtual interfaces like cali*, docker* is used by container/kubernetes.
    We need to suppress lldp frames on these interfaces.

    Change-Id: I38e29c4d691cd4be30954136d7e1a43b0f61c925
    Closes-bug: #1815804