diff --git a/files/post-up-checksum-rules b/files/post-up-checksum-rules deleted file mode 100644 index f640b525..00000000 --- a/files/post-up-checksum-rules +++ /dev/null @@ -1,42 +0,0 @@ -#!/usr/bin/env bash -# Copyright 2014, Rackspace US, Inc. -# -# Licensed under the Apache License, Version 2.0 (the "License"); -# you may not use this file except in compliance with the License. -# You may obtain a copy of the License at -# -# http://www.apache.org/licenses/LICENSE-2.0 -# -# Unless required by applicable law or agreed to in writing, software -# distributed under the License is distributed on an "AS IS" BASIS, -# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -# See the License for the specific language governing permissions and -# limitations under the License. - -# NOTICE: -# This script is purpose built to resolve an issue within neutron -# where packet checksums are being dropped. -# Launchpad issue: -# https://bugs.launchpad.net/bugs/1244589 -# -# Open review: -# https://review.openstack.org/#/c/148718/ -# -# TODO(cloudnull) remove this script once the bug is fixed. - - -# Iptables path, used for ipv4 firewall. -IPTABLES=$(which iptables) -if [ ! -z "${IPTABLES}" ]; then - if ! ${IPTABLES} -C POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill 2> /dev/null; then - ${IPTABLES} -A POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill - fi -fi - -# Ip6tables path, used for ipv6 firewall. -IP6TABLES=$(which ip6tables) -if [ ! -z "${IP6TABLES}" ]; then - if ! ${IP6TABLES} -C POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill 2> /dev/null; then - ${IP6TABLES} -A POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill - fi -fi diff --git a/tasks/neutron_post_install.yml b/tasks/neutron_post_install.yml index bff80f83..bcf95211 100644 --- a/tasks/neutron_post_install.yml +++ b/tasks/neutron_post_install.yml @@ -121,23 +121,11 @@ tags: - neutron_config -- name: Drop iptables checksum fix - copy: - src: "post-up-checksum-rules" - dest: "/etc/network/if-up.d/post-up-checksum-rules" - owner: "root" - group: "root" - mode: "0755" - when: > - inventory_hostname in groups[neutron_services['neutron-linuxbridge-agent']['group']] - tags: - - neutron-config - - neutron-checksum-fix - -- name: Run iptables checksum fix - command: /etc/network/if-up.d/post-up-checksum-rules - when: > - inventory_hostname in groups[neutron_services['neutron-linuxbridge-agent']['group']] +#TODO(jmccrory): Remove this task prior to Newton release +- name: Remove iptables checksum fix script + file: + path: /etc/network/if-up.d/post-up-checksum-rules + state: absent tags: - neutron-config - neutron-checksum-fix diff --git a/tests/test-install-neutron.yml b/tests/test-install-neutron.yml index 3d8ec771..59274769 100644 --- a/tests/test-install-neutron.yml +++ b/tests/test-install-neutron.yml @@ -18,6 +18,28 @@ user: root gather_facts: true pre_tasks: + - name: Use the unconfined aa profile + lxc_container: + name: "{{ container_name }}" + container_config: + - "lxc.aa_profile=unconfined" + delegate_to: "{{ physical_host }}" + - name: Neutron extra lxc config + lxc_container: + name: "{{ container_name }}" + container_command: | + [[ ! -d "/lib/modules" ]] && mkdir -p "/lib/modules" + container_config: + - "lxc.cgroup.devices.allow=a *:* rmw" + - "lxc.mount.entry=/lib/modules lib/modules none bind 0 0" + delegate_to: "{{ physical_host }}" + - name: Wait for ssh to be available + local_action: + module: wait_for + port: "{{ ansible_ssh_port | default('22') }}" + host: "{{ ansible_ssh_host | default(inventory_hostname) }}" + search_regex: OpenSSH + delay: 1 - name: Ensure rabbitmq vhost rabbitmq_vhost: name: "{{ neutron_rabbitmq_vhost }}" @@ -112,7 +134,7 @@ neutron_developer_mode: true neutron_provider_networks: network_flat_networks: "flat" - network_mappings: "flat:eth12,vlan:eth11" + network_mappings: "flat:{{ ansible_default_ipv4.interface }}" network_types: "vxlan,flat,vlan" network_vlan_ranges: "vlan:1:1,vlan:1024:1025" network_vxlan_ranges: "1:1000" diff --git a/tests/test-neutron-functional.yml b/tests/test-neutron-functional.yml index aa688fb2..0917d554 100644 --- a/tests/test-neutron-functional.yml +++ b/tests/test-neutron-functional.yml @@ -27,6 +27,15 @@ url: "http://localhost:9696" status_code: 200 +- name: Ensure that the DHCP agent is alive + shell: | + . /root/openrc + neutron agent-list | grep DHCP + register: neutron_dhcp_agent + until: neutron_dhcp_agent.stdout.find(':-)') != -1 + retries: 5 + delay: 10 + - name: Create test network neutron: command: create_network @@ -46,8 +55,22 @@ . /root/openrc neutron port-create --name test-port test-network register: neutron_port_create + until: neutron_port_create.rc == 0 + retries: 5 + delay: 10 -- name: Ensure neutron port was created successfully - assert: - that: - - neutron_port_create.rc == 0 +- name: Check for dhcp network namespace + shell: | + ip netns | grep "^qdhcp" + register: dhcp_namespace + until: dhcp_namespace.rc == 0 + retries: 5 + delay: 10 + +- name: Check for iptables checksum rule + shell: | + ip netns exec {{ dhcp_namespace.stdout }} iptables -C neutron-dhcp-age-POSTROUTING -t mangle -p udp --dport 68 -j CHECKSUM --checksum-fill + register: checksum_rule + until : checksum_rule.rc == 0 + retries: 5 + delay: 10