Merge "neutron: Run metadata extension in OVN agent"

5 files changed, 38 insertions, 2 deletions

diff --git a/ansible/group_vars/all/neutron.yml b/ansible/group_vars/all/neutron.yml
index e77957784..a723eb9f4 100644
--- a/ansible/group_vars/all/neutron.yml
+++ b/ansible/group_vars/all/neutron.yml
@@ -17,7 +17,7 @@ enable_neutron_taas: false
 enable_neutron_trunk: false
 enable_neutron_metering: false
 enable_neutron_port_forwarding: false
-neutron_enable_ovn_agent: false
+neutron_enable_ovn_agent: "{{ neutron_plugin_agent == 'ovn' }}"
 
 neutron_keystone_user: "neutron"
 
diff --git a/ansible/roles/neutron/defaults/main.yml b/ansible/roles/neutron/defaults/main.yml
index 93ec57321..059f2ce6a 100644
--- a/ansible/roles/neutron/defaults/main.yml
+++ b/ansible/roles/neutron/defaults/main.yml
@@ -158,7 +158,7 @@ neutron_services:
     container_name: "neutron_ovn_metadata_agent"
     image: "{{ neutron_ovn_metadata_agent_image_full }}"
     privileged: true
-    enabled: "{{ neutron_plugin_agent == 'ovn' }}"
+    enabled: false
     host_in_groups: "{{ inventory_hostname in groups['neutron-ovn-metadata-agent'] }}"
     volumes: "{{ neutron_ovn_metadata_agent_default_volumes + neutron_ovn_metadata_agent_extra_volumes }}"
     dimensions: "{{ neutron_ovn_metadata_agent_dimensions }}"
@@ -206,6 +206,17 @@ neutron_services:
     volumes: "{{ neutron_ovn_agent_default_volumes + neutron_ovn_agent_extra_volumes }}"
     dimensions: "{{ neutron_ovn_agent_dimensions }}"
     healthcheck: "{{ neutron_ovn_agent_healthcheck }}"
+    cap_add:
+      - DAC_OVERRIDE
+      - DAC_READ_SEARCH
+      - NET_ADMIN
+      - SYS_ADMIN
+      - SYS_PTRACE
+    security_opt:
+      - "apparmor=unconfined"
+      - "label=disable"
+      - "seccomp=unconfined"
+    systempaths_unconfined: true
   neutron-ovn-vpn-agent:
     container_name: "neutron_ovn_vpn_agent"
     image: "{{ neutron_ovn_vpn_agent_image_full }}"
@@ -652,6 +663,9 @@ ironic_neutron_agent_default_volumes:
   - "{{ '/dev/shm:/dev/shm' }}"
 neutron_ovn_agent_default_volumes:
   - "{{ node_config_directory }}/neutron-ovn-agent/:{{ container_config_directory }}/:ro"
+  - "neutron_metadata_socket:/var/lib/neutron/kolla/"
+  - "/run/openvswitch:/run/openvswitch:shared"
+  - "/run/netns:/run/netns:shared"
   - "kolla_logs:/var/log/kolla/"
   - "{{ '/dev/shm:/dev/shm' }}"
 neutron_ovn_maintenance_worker_default_volumes:
diff --git a/ansible/roles/neutron/handlers/main.yml b/ansible/roles/neutron/handlers/main.yml
index 08f1faf87..4fa023096 100644
--- a/ansible/roles/neutron/handlers/main.yml
+++ b/ansible/roles/neutron/handlers/main.yml
@@ -313,6 +313,9 @@
     dimensions: "{{ service.dimensions }}"
     privileged: "{{ service.privileged | default(False) }}"
     healthcheck: "{{ service.healthcheck | default(omit) }}"
+    cap_add: "{{ service.cap_add | default(omit) }}"
+    security_opt: "{{ service.security_opt | default(omit) }}"
+    systempaths_unconfined: "{{ service.systempaths_unconfined | default(omit) }}"
 
 - name: Restart neutron-ovn-vpn-agent container
   vars:
diff --git a/ansible/roles/neutron/templates/ovn_agent.ini.j2 b/ansible/roles/neutron/templates/ovn_agent.ini.j2
index bf5761353..fd73e766f 100644
--- a/ansible/roles/neutron/templates/ovn_agent.ini.j2
+++ b/ansible/roles/neutron/templates/ovn_agent.ini.j2
@@ -1,3 +1,17 @@
+[DEFAULT]
+auth_ca_cert = {{ openstack_cacert }}
+nova_metadata_protocol = {{ internal_protocol }}
+metadata_proxy_socket = /var/lib/neutron/kolla/metadata_proxy
+nova_metadata_host = {{ nova_internal_fqdn }}
+nova_metadata_port = {{ nova_metadata_port }}
+metadata_proxy_shared_secret = {{ metadata_secret }}
+log_file = neutron-ovn-agent.log
+log_dir = /var/log/kolla/neutron
+metadata_workers = {{ neutron_metadata_workers }}
+
+[agent]
+extensions = metadata
+
 [ovn]
 ovn_nb_connection = {{ ovn_nb_connection }}
 ovn_sb_connection = {{ ovn_sb_connection }}
diff --git a/releasenotes/notes/neutron-ovn-agent-metadata-b3654a921e23de6b.yaml b/releasenotes/notes/neutron-ovn-agent-metadata-b3654a921e23de6b.yaml
new file mode 100644
index 000000000..f07336e17
--- /dev/null
+++ b/releasenotes/notes/neutron-ovn-agent-metadata-b3654a921e23de6b.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - |
+    The ``neutron-ovn-agent`` now runs metadata service, since the
+    ``neutron-ovn-metadata-agent`` has been dropped in Neutron.