From 4f5dda873762438b3ba296da289dae5f3312c9da Mon Sep 17 00:00:00 2001 From: Maximilian Stinsky Date: Fri, 19 Jul 2024 12:35:19 +0200 Subject: Implement neutron-ovn-vpn-agent This patch implements vpnaas for OVN environments. It deploys a standalone neutron-ovn-vpn-agent on neutron nodes. The container no longer requires 'privileged: true'. Running as the 'neutron' user with specific kernel capabilities ensures the agent can manage network namespaces and interfaces without full privileges. Added capabilities: - NET_ADMIN # manage interfaces, IPs, routing, firewall - SYS_ADMIN # create/manage network namespaces - SYS_PTRACE # allow 'ip netns exec' attach to processes - DAC_OVERRIDE # bypass file read/write restrictions - DAC_READ_SEARCH # allow directory traversal and file read - SETPCAP # retain capabilities for privileged ops Added security options: - apparmor=unconfined # disable AppArmor confinement - seccomp=unconfined # disable seccomp filtering - label=disable # disable SELinux/labeling Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302 Closes-Bug: #2048392 Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5 Signed-off-by: Joachim de Groot Signed-off-by: Piotr Milewski --- .../reference/networking/neutron-extensions.rst | 41 ++++++++++++++-------- 1 file changed, 26 insertions(+), 15 deletions(-) (limited to 'doc') diff --git a/doc/source/reference/networking/neutron-extensions.rst b/doc/source/reference/networking/neutron-extensions.rst index 2e8be4b13..e56968dd5 100644 --- a/doc/source/reference/networking/neutron-extensions.rst +++ b/doc/source/reference/networking/neutron-extensions.rst @@ -45,6 +45,13 @@ For more information on FWaaS in Neutron refer to the Neutron VPNaaS (VPN-as-a-Service) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ +.. warning:: + + OVN VPNaaS is currently not supported on RHEL 10 based distributions + (e.g., Rocky Linux 10, CentOS Stream 10) due to an upstream bug in + Neutron. See `LP#2146308 `_ + for details. + Preparation and deployment -------------------------- @@ -60,15 +67,20 @@ Verification VPNaaS is a complex subject, hence this document provides directions for a simple smoke test to verify the service is up and running. -On the network node(s), the ``neutron_vpnaas_agent`` should be up (image naming -and versioning may differ depending on deploy configuration): +In ml2/ovn setups a special neutron_ovn_vpn_agent is running on neutron +node(s). +Version may differ depending on deploy configuration: .. code-block:: console - # docker ps --filter name=neutron_vpnaas_agent + # docker ps --filter name=neutron_ovn_vpn_agent + + CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES + 7f6efad28d30 kolla/neutron-ovn-vpn-agent:18.1.0 "dumb-init --single-…" 7 days ago Up 7 days (healthy) neutron_ovn_vpn_agent + +On ml2/ovs deployments there is no special agent. +The vpnaas code is running inside the neutron_l3_agent container. - CONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES - 97d25657d55e operator:5000/kolla/centos-source-neutron-vpnaas-agent:4.0.0 "kolla_start" 44 minutes ago Up 44 minutes neutron_vpnaas_agent .. warning:: @@ -92,21 +104,20 @@ Verify both VPN services are active: .. code-block:: console - # neutron vpn-service-list + # openstack vpn service list - +--------------------------------------+----------+--------------------------------------+--------+ - | id | name | router_id | status | - +--------------------------------------+----------+--------------------------------------+--------+ - | ad941ec4-5f3d-4a30-aae2-1ab3f4347eb1 | vpn_west | 051f7ce3-4301-43cc-bfbd-7ffd59af539e | ACTIVE | - | edce15db-696f-46d8-9bad-03d087f1f682 | vpn_east | 058842e0-1d01-4230-af8d-0ba6d0da8b1f | ACTIVE | - +--------------------------------------+----------+--------------------------------------+--------+ + +--------------------------------------+----------+--------------------------------------+--------+--------+-------+--------+ + | ID | Name | Router | Subnet | Flavor | State | Status | + +--------------------------------------+----------+--------------------------------------+--------+--------+-------+--------+ + | 03f85023-28d9-4f35-a10e-2c8dd3c11b65 | vpn_west | e3603217-fd22-404c-b27e-9285c2a79a17 | None | None | True | ACTIVE | + | 1abdc71a-2eb7-4b2a-8871-eb9d91f39957 | vpn_east | 3485bdd2-4c42-449e-ae9f-d071a8cb9e5c | None | None | True | ACTIVE | + +--------------------------------------+----------+--------------------------------------+--------+--------+-------+--------+ Two VMs can now be booted, one on vpn_east, the other on vpn_west, and encrypted ping packets observed being sent from one to the other. -For more information on this and VPNaaS in Neutron refer to the -:neutron-vpnaas-doc:`Neutron VPNaaS Testing ` -and the `OpenStack wiki `_. +For more information on VPNaaS in Neutron refer to the +`OpenStack docs `_. Trunking ~~~~~~~~ -- cgit v1.2.3