diff options
| author | Maximilian Stinsky <maximilian.stinsky-damke@wiit.cloud> | 2024-07-19 12:35:19 +0200 |
|---|---|---|
| committer | Piotr Milewski <vurmil@gmail.com> | 2026-04-17 09:07:00 +0000 |
| commit | 4f5dda873762438b3ba296da289dae5f3312c9da (patch) | |
| tree | e5dc0742dcb8c48c3125e00c601c9ffb20a28a5d /tests | |
| parent | 88aecb6009d2ef6e543849cd9930d1bd80cfca2f (diff) | |
| download | kolla-ansible-4f5dda873762438b3ba296da289dae5f3312c9da.tar.gz kolla-ansible-4f5dda873762438b3ba296da289dae5f3312c9da.zip | |
Implement neutron-ovn-vpn-agent
This patch implements vpnaas for OVN environments. It deploys
a standalone neutron-ovn-vpn-agent on neutron nodes.
The container no longer requires 'privileged: true'. Running
as the 'neutron' user with specific kernel capabilities ensures
the agent can manage network namespaces and interfaces without
full privileges.
Added capabilities:
- NET_ADMIN # manage interfaces, IPs, routing, firewall
- SYS_ADMIN # create/manage network namespaces
- SYS_PTRACE # allow 'ip netns exec' attach to processes
- DAC_OVERRIDE # bypass file read/write restrictions
- DAC_READ_SEARCH # allow directory traversal and file read
- SETPCAP # retain capabilities for privileged ops
Added security options:
- apparmor=unconfined # disable AppArmor confinement
- seccomp=unconfined # disable seccomp filtering
- label=disable # disable SELinux/labeling
Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302
Closes-Bug: #2048392
Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5
Signed-off-by: Joachim de Groot <joachim.de.groot@menzel-it.net>
Signed-off-by: Piotr Milewski <vurmil@gmail.com>
Diffstat (limited to 'tests')
| -rw-r--r-- | tests/run.yml | 8 | ||||
| -rw-r--r-- | tests/templates/globals-default.j2 | 1 | ||||
| -rw-r--r-- | tests/templates/inventory.j2 | 3 |
3 files changed, 12 insertions, 0 deletions
diff --git a/tests/run.yml b/tests/run.yml index 78d34d8eb..775eb2630 100644 --- a/tests/run.yml +++ b/tests/run.yml @@ -429,6 +429,14 @@ SCENARIO: "{{ scenario }}" when: openstack_core_tested or scenario in ['ironic', 'magnum', 'nfv', 'zun', 'octavia'] + - name: Test OVN VPNaaS + import_role: + name: test-ovn-vpnaas + when: + - scenario == 'ovn' + # FIXME(neutron): Enable when https://bugs.launchpad.net/neutron/+bug/2146308 is fixed + - not (ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '10') + - name: Run test-ovn.sh script script: cmd: test-ovn.sh diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2 index 313e7d5cf..d313d97e7 100644 --- a/tests/templates/globals-default.j2 +++ b/tests/templates/globals-default.j2 @@ -195,6 +195,7 @@ neutron_plugin_agent: "ovn" neutron_ovn_distributed_fip: "yes" neutron_enable_ovn_agent: "yes" ovn_sb_db_relay_count: "3" +enable_neutron_vpnaas: "yes" enable_octavia: "yes" octavia_provider_drivers: "ovn:OVN provider" octavia_provider_agents: "ovn" diff --git a/tests/templates/inventory.j2 b/tests/templates/inventory.j2 index 9a7787b31..a5001a55a 100644 --- a/tests/templates/inventory.j2 +++ b/tests/templates/inventory.j2 @@ -347,6 +347,9 @@ control compute network +[neutron-ovn-vpn-agent:children] +neutron + # Cinder [cinder-api:children] cinder |