a99ab7002c
openvswitch firewall has been in Neutron tree since Newton and has gone through lots of improvements since including simple upgrade path from the iptables hybrid driver. We have a tempest job running in Neutron tree with openvswitch firewall that's been voting and stable for a while. For neutron_tempest_plugin, we have had the openvswitch firewall in use since the beginning. This patch proposes openvswitch firewall driver to become a default driver for openvswitch agent deployments. Change-Id: If26d0180e459210511f25f1faa83dd8ccea25ff4
128 lines
4.1 KiB
Bash
128 lines
4.1 KiB
Bash
#!/bin/bash
|
|
#
|
|
# common functions for ovs based plugin
|
|
# -------------------------------------
|
|
|
|
# Save trace setting
|
|
_XTRACE_NEUTRON_OVS_BASE=$(set +o | grep xtrace)
|
|
set +o xtrace
|
|
|
|
OVS_BRIDGE=${OVS_BRIDGE:-br-int}
|
|
# OVS recognize default 'system' datapath or 'netdev' for userspace datapath
|
|
OVS_DATAPATH_TYPE=${OVS_DATAPATH_TYPE:-system}
|
|
OVS_TUNNEL_BRIDGE=${OVS_TUNNEL_BRIDGE:-br-tun}
|
|
|
|
function is_neutron_ovs_base_plugin {
|
|
# Yes, we use OVS.
|
|
return 0
|
|
}
|
|
|
|
function _neutron_ovs_base_add_bridge {
|
|
local bridge=$1
|
|
local addbr_cmd="sudo ovs-vsctl -- --may-exist add-br $bridge"
|
|
|
|
if [ "$OVS_DATAPATH_TYPE" != "system" ] ; then
|
|
addbr_cmd="$addbr_cmd -- set Bridge $bridge datapath_type=${OVS_DATAPATH_TYPE}"
|
|
fi
|
|
|
|
$addbr_cmd
|
|
}
|
|
|
|
function _neutron_ovs_base_setup_bridge {
|
|
local bridge=$1
|
|
neutron-ovs-cleanup --config-file $NEUTRON_CONF
|
|
_neutron_ovs_base_add_bridge $bridge
|
|
sudo ovs-vsctl --no-wait br-set-external-id $bridge bridge-id $bridge
|
|
}
|
|
|
|
function neutron_ovs_base_cleanup {
|
|
# remove all OVS ports that look like Neutron created ports
|
|
for port in $(sudo ovs-vsctl list port | grep -o -e [a-zA-Z\-]*tap[0-9a-f\-]* -e q[rg]-[0-9a-f\-]*); do
|
|
sudo ovs-vsctl del-port ${port}
|
|
done
|
|
|
|
# remove all OVS bridges created by Neutron
|
|
for bridge in $(sudo ovs-vsctl list-br | grep -o -e ${OVS_BRIDGE} -e ${PUBLIC_BRIDGE} -e ${OVS_TUNNEL_BRIDGE}); do
|
|
sudo ovs-vsctl del-br ${bridge}
|
|
done
|
|
}
|
|
|
|
function _neutron_ovs_base_install_ubuntu_dkms {
|
|
# install Dynamic Kernel Module Support packages if needed
|
|
local kernel_version
|
|
kernel_version=$(uname -r)
|
|
local kernel_major_minor
|
|
kernel_major_minor=`echo $kernel_version | cut -d. -f1-2`
|
|
# From kernel 3.13 on, openvswitch-datapath-dkms is not needed
|
|
if vercmp "$kernel_major_minor" "<" "3.13" ; then
|
|
install_package "dkms openvswitch-datapath-dkms linux-headers-$kernel_version"
|
|
fi
|
|
}
|
|
|
|
function _neutron_ovs_base_install_agent_packages {
|
|
# Install deps
|
|
install_package $(get_packages "openvswitch")
|
|
if is_ubuntu; then
|
|
_neutron_ovs_base_install_ubuntu_dkms
|
|
restart_service openvswitch-switch
|
|
elif is_fedora; then
|
|
restart_service openvswitch
|
|
sudo systemctl enable openvswitch
|
|
elif is_suse; then
|
|
if [[ $DISTRO == "sle12" ]] && [[ $os_RELEASE -lt 12.2 ]]; then
|
|
restart_service openvswitch-switch
|
|
else
|
|
# workaround for https://bugzilla.suse.com/show_bug.cgi?id=1085971
|
|
if [[ $DISTRO =~ "tumbleweed" ]]; then
|
|
sudo sed -i -e "s,^OVS_USER_ID=.*,OVS_USER_ID='root:root'," /etc/sysconfig/openvswitch
|
|
fi
|
|
restart_service openvswitch || {
|
|
journalctl -xe || :
|
|
systemctl status openvswitch
|
|
}
|
|
fi
|
|
fi
|
|
}
|
|
|
|
function _neutron_ovs_base_configure_firewall_driver {
|
|
if [[ "$Q_USE_SECGROUP" == "True" ]]; then
|
|
iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver openvswitch
|
|
if ! running_in_container; then
|
|
enable_kernel_bridge_firewall
|
|
fi
|
|
else
|
|
iniset /$Q_PLUGIN_CONF_FILE securitygroup firewall_driver noop
|
|
fi
|
|
}
|
|
|
|
function _neutron_ovs_base_configure_l3_agent {
|
|
if [ "$Q_USE_PROVIDERNET_FOR_PUBLIC" != "True" ]; then
|
|
iniset $Q_L3_CONF_FILE DEFAULT external_network_bridge $PUBLIC_BRIDGE
|
|
fi
|
|
|
|
neutron-ovs-cleanup --config-file $NEUTRON_CONF
|
|
if [[ "$Q_USE_PUBLIC_VETH" = "True" ]]; then
|
|
ip link show $Q_PUBLIC_VETH_INT > /dev/null 2>&1 ||
|
|
sudo ip link add $Q_PUBLIC_VETH_INT type veth \
|
|
peer name $Q_PUBLIC_VETH_EX
|
|
sudo ip link set $Q_PUBLIC_VETH_INT up
|
|
sudo ip link set $Q_PUBLIC_VETH_EX up
|
|
sudo ip addr flush dev $Q_PUBLIC_VETH_EX
|
|
else
|
|
_neutron_ovs_base_add_public_bridge
|
|
sudo ovs-vsctl br-set-external-id $PUBLIC_BRIDGE bridge-id $PUBLIC_BRIDGE
|
|
fi
|
|
}
|
|
|
|
function _neutron_ovs_base_add_public_bridge {
|
|
_neutron_ovs_base_add_bridge $PUBLIC_BRIDGE
|
|
set_mtu $PUBLIC_BRIDGE $PUBLIC_BRIDGE_MTU
|
|
}
|
|
|
|
function _neutron_ovs_base_configure_nova_vif_driver {
|
|
:
|
|
}
|
|
|
|
# Restore xtrace
|
|
$_XTRACE_NEUTRON_OVS_BASE
|