From 4f5dda873762438b3ba296da289dae5f3312c9da Mon Sep 17 00:00:00 2001 From: Maximilian Stinsky Date: Fri, 19 Jul 2024 12:35:19 +0200 Subject: Implement neutron-ovn-vpn-agent This patch implements vpnaas for OVN environments. It deploys a standalone neutron-ovn-vpn-agent on neutron nodes. The container no longer requires 'privileged: true'. Running as the 'neutron' user with specific kernel capabilities ensures the agent can manage network namespaces and interfaces without full privileges. Added capabilities: - NET_ADMIN # manage interfaces, IPs, routing, firewall - SYS_ADMIN # create/manage network namespaces - SYS_PTRACE # allow 'ip netns exec' attach to processes - DAC_OVERRIDE # bypass file read/write restrictions - DAC_READ_SEARCH # allow directory traversal and file read - SETPCAP # retain capabilities for privileged ops Added security options: - apparmor=unconfined # disable AppArmor confinement - seccomp=unconfined # disable seccomp filtering - label=disable # disable SELinux/labeling Depends-On: https://review.opendev.org/c/openstack/kolla/+/924302 Closes-Bug: #2048392 Change-Id: I961b1407ae1402d146f0c09924df8e007e331af5 Signed-off-by: Joachim de Groot Signed-off-by: Piotr Milewski --- tests/run.yml | 8 ++++++++ tests/templates/globals-default.j2 | 1 + tests/templates/inventory.j2 | 3 +++ 3 files changed, 12 insertions(+) (limited to 'tests') diff --git a/tests/run.yml b/tests/run.yml index 78d34d8eb..775eb2630 100644 --- a/tests/run.yml +++ b/tests/run.yml @@ -429,6 +429,14 @@ SCENARIO: "{{ scenario }}" when: openstack_core_tested or scenario in ['ironic', 'magnum', 'nfv', 'zun', 'octavia'] + - name: Test OVN VPNaaS + import_role: + name: test-ovn-vpnaas + when: + - scenario == 'ovn' + # FIXME(neutron): Enable when https://bugs.launchpad.net/neutron/+bug/2146308 is fixed + - not (ansible_facts.os_family == 'RedHat' and ansible_facts.distribution_major_version == '10') + - name: Run test-ovn.sh script script: cmd: test-ovn.sh diff --git a/tests/templates/globals-default.j2 b/tests/templates/globals-default.j2 index 313e7d5cf..d313d97e7 100644 --- a/tests/templates/globals-default.j2 +++ b/tests/templates/globals-default.j2 @@ -195,6 +195,7 @@ neutron_plugin_agent: "ovn" neutron_ovn_distributed_fip: "yes" neutron_enable_ovn_agent: "yes" ovn_sb_db_relay_count: "3" +enable_neutron_vpnaas: "yes" enable_octavia: "yes" octavia_provider_drivers: "ovn:OVN provider" octavia_provider_agents: "ovn" diff --git a/tests/templates/inventory.j2 b/tests/templates/inventory.j2 index 9a7787b31..a5001a55a 100644 --- a/tests/templates/inventory.j2 +++ b/tests/templates/inventory.j2 @@ -347,6 +347,9 @@ control compute network +[neutron-ovn-vpn-agent:children] +neutron + # Cinder [cinder-api:children] cinder -- cgit v1.2.3