yahoo-eng-team team mailing list archive

[OpenStack Infra <1811166@xxxxxxxxxxxxxxxxxx>]

Reviewed:  https://review.opendev.org/625134
Committed: https://git.openstack.org/cgit/openstack/neutron/commit/?id=00b6460df2748cbf0bfa8fccdaad6a7356c15388
Submitter: Zuul
Branch:    master

commit 00b6460df2748cbf0bfa8fccdaad6a7356c15388
Author: Matt Welch <matt.welch@xxxxxxxxx>
Date:   Thu Dec 13 15:52:34 2018 -0800

    Enforce router admin state before distributed
    
    Enforce that a user updates the admin state of a router before modifying
    the distributed state. The API currently allows setting admin state to
    false concurrently with changing the distributed state.
    This is fine for a transition of centralized->distributed, but the
    distributed->centralized transition could leave other nodes configured
    as distributed until an audit is performed.
    
    Commit adds shim api extension which should be replaced by neutron-lib
    shim extension once https://review.openstack.org/#/c/634509/ is merged.
    New method 'is_admin_state_down_necessary' checks that shim extension
    is loaded.
    
    Set extension as standard by adding to _supported_extension_aliases in
    neutron/services/l3_router/l3_router_plugin.py
    
    Closes-Bug: #1811166
    Co-Authored-By: Allain Legacy <allain.legacy@xxxxxxxxxxxxx>
    Co-Authored-By: Enyinna Ochulor <enyinna.ochulor@xxxxxxxxx>
    Change-Id: Ie624aeb3f3aeb4db176d2ca0b22020208d4b408a
    Signed-off-by: Matt Welch <matt.welch@xxxxxxxxx>


** Changed in: neutron
       Status: In Progress => Fix Released

-- 
You received this bug notification because you are a member of Yahoo!
Engineering Team, which is subscribed to neutron.
https://bugs.launchpad.net/bugs/1811166

Title:
  Enforce router admin_state_up=False before distributed update

Status in neutron:
  Fix Released

Bug description:
  Until now, the API has allowed changing the distributed attribute of a
  router in the same request with changing its admin-state-up attribute
  to False.  This does not seem to cause a problem when upgrading a
  router from centralized to distributed, but downgrading a distributed
  router to centralized can cause an issue.

  When the distributed attribute is set to false, then a notification
  should be sent to the node hosting the centralized router or all of
  the nodes hosting the distributed router.  If the distributed
  attribute is set to false, the notification will only to one node,
  resulting in all the other instances of the distributed router getting
  stuck configured as distributed. This can affect communication to VM
  instances until the L3 agent realizes the router is no longer set to
  distributed and cleans up the node.  This delay can be as long as the
  length of the agent audit interval.

  Rather than remembering the old state of the router, we have chosen to
  enforce that the user update the admin-state-up attribute to false
  before changing the distributed attribute.  Effectively, routers will
  need to be in admin-state-up=False to modify the distributed
  attribute.  Once disabled, the user can modify the distributed
  attribute and admin state in a single request.

  Before this change the following was possible:

      neutron router-update tenant2-router --distributed false  --admin-state-up false
      neutron router-update tenant2-router --admin-state-up true

  After this change the following is required:

      neutron router-update tenant2-router --admin-state-up false
      neutron router-update tenant2-router --distributed false  --admin-state-up true

  Horizon workflows may need a similar restriction.

  *Version*
  OpenStack installed via devstack, git hash d1fe5ad507c6dcb6955d66fab0b6bc9fb59a80f2
  Neutron git hash 77a8b020c3da77fd0329ae349a2cab952e4bc37a

To manage notifications about this bug go to:
https://bugs.launchpad.net/neutron/+bug/1811166/+subscriptions