Add validation to disallow OVS round-robin bonding

[Assaf Muller]

OVS balance-tcp mode bonding is known to cause packet loss issues in modern versions of OVS. More information may be found here: https://bugzilla.redhat.com/show_bug.cgi?id=1267291.

This request is for TripleO, perhaps os-net-config to validate input so that this particular bonding mode is forbidden, and that TripleO will throw an error instead of configuring it having users complain of connectivity issues much later.

[Dan Sneddon (dsneddon)]

The applicable resource is the BondInterfaceOvsOptions parameter. When this is set to configure OVS for "balance-tcp" mode, a packet-loss bug is triggered in OVS 2.4.

Today this data is usually set in the parameter_defaults section of the network-environment.yaml, and that parameter is used in the various NIC config templates that are assigned to each role.

There is no handling of this parameter within the TripleO Heat Templates, except to pass that parameter to the NetworkConfig stack. The value is not written to /etc/puppet/hieradata, nor is it used by Puppet, so the validation can't happen within Puppet.

Since this is a freeform string parameter, we will need to use a regular expression or simple pattern match for "balance-tcp" in this parameter. We might be able to include this in the TripleO validations. I hesitate to add a check within os-net-config, simply because by the time os-net-config has run the deployment is already more than halfway done. We should ideally do this validation before kicking off the node deployments.

[Brent Eagles (beagles)]

Agreed. I'm testing using allowed-pattern constraints on the template parameter to see if we can block it there.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/355073

[Brent Eagles (beagles)]

Pulled from review comments (good points, thanks bnemec!)

"... this constraint needs to be added to our nic-configs since those are where the bond options get applied to a system. Actually, I still think we need a proper external validation for this since it involves templates that users will be editing, and thus may have existing versions without this constraint that will be carried forward into this release, but I'm good with this as a partial fix until the validations framework is fully integrated.
Note that we also need to fix the examples in http://docs.openstack.org/developer/tripleo-docs/advanced_deployment/network_isolation.html to include the constraint, besides the sample nic-configs we ship in t-h-t."

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/355073
Committed: https://git.openstack.org/cgit/openstack/tripleo-heat-templates/commit/?id=6298b7c35ed4a7411d8e8da1008efc0f585ffb75
Submitter: Jenkins
Branch: master

commit 6298b7c35ed4a7411d8e8da1008efc0f585ffb75
Author: Brent Eagles <email address hidden>
Date: Fri Aug 12 18:07:24 2016 -0230

    Add constraint to prohibit balance-tcp from BondInterfaceOvsOptions

    This patch adds an allowed_pattern contraint that uses a negative
    lookahead assertion to only allow options strings that do not contain
    the 'balance-tcp' option.

    Change-Id: Icf8874e4e585f9a42d38091f8b38c3685f403cf1
    Partial-Bug: #1612786

[Brent Eagles (beagles)]

Where this is only a partial fix, I propose bumping the bug to Ocata.

[Brent Eagles (beagles)]

Actually re-reading Ben's comments, there is still doc and example clean up work that should be done for this release.

[OpenStack Infra (hudson-openstack)]

Fix proposed to branch: master
Review: https://review.openstack.org/372590

[OpenStack Infra (hudson-openstack)]

Reviewed: https://review.openstack.org/372590
Committed: https://git.openstack.org/cgit/openstack/tripleo-docs/commit/?id=b4892e6f3d1269983621d8c827cf4a98e42b222a
Submitter: Jenkins
Branch: master

commit b4892e6f3d1269983621d8c827cf4a98e42b222a
Author: Brent Eagles <email address hidden>
Date: Mon Sep 19 13:11:00 2016 -0230

    Remove references to balance-tcp

    Due to repeated reports of package loss using the balance-tcp bond mode
    with OVS, we've added a constraint* to prohibit its use. This document
    update removes references to that bond mode in the network isolation
    configuration examples.

    * https://review.openstack.org/#/c/355073/

    Change-Id: I42a22b01d4e3c1fdb76441a4ca9b7c666a96fada
    Partial-Bug: #1612786

[Brent Eagles (beagles)]

The patches that are appropriate for newton have merged (hot validation and docs). Checks via validation framework are deferred to Ocata.

[Alex Schultz (alex-schultz)]

This appears to not have any open patches and hasn't been updated in some time. Moving backed to triaged.

[Emilien Macchi (emilienm)]

This is an automated cleanup. This bug report has been closed because it
is older than 18 months and there is no open code change to fix this.
After this time it is unlikely that the circumstances which lead to
the observed issue can be reproduced.

If you can reproduce the bug, please:
* reopen the bug report (set to status "New")
* AND add the detailed steps to reproduce the issue (if applicable)
* AND leave a comment "CONFIRMED FOR: <RELEASE_NAME>"
  Only still supported release names are valid (FUTURE, PIKE, QUEENS, ROCKY, STEIN).
  Valid example: CONFIRMED FOR: FUTURE